gh-fix-ci

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow uses gh run view <run_id> --log and/or gh api "/repos/<owner>/<repo>/actions/jobs/<job_id>/logs" to ingest GitHub Actions job log text authored by other parties (e.g., CI steps/committers), which is then summarized into the agent’s LLM context—an outsider-authored free-text injection surface.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent to obtain escalated/sandbox-bypassing permissions (e.g., rerun gh auth status with sandbox_permissions=require_escalated and request workflow/repo scopes), which directs the agent to bypass sandbox/security controls and elevate its privileges.