fix-pr-comments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The workflow explicitly fetches and ingests outsider-authored PR review content (top-level comments, reviews, unresolved review threads, and pending review comments) via the GitHub connector and gh api repos/<owner>/<repo>/pulls/<pr>/comments / reviewThreads(...), which are free-form text written by non-operating-user contributors.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches runtime GitHub data (e.g., "gh api repos///issues//comments" and "gh api repos///pulls//comments" and related gh/GraphQL calls) and uses those review comments/threads as the actionable feedback that directs edits, so external content from those endpoints directly controls the agent's instructions.