pr-handoff

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source SKILL.md requires reading the GitHub PR diff (via git diff "$BASE"...HEAD and gh repo view ... to resolve base), which means the outsider-authored PR description/content is fetched at runtime by the workflow and then drives the screenshot routing.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly includes privileged package-install commands (sudo apt-get / sudo dnf) and also automates writing and pushing an assets branch (git worktree / commit / push), both of which modify the machine or repository state — even though the text instructs to ask before sudo, the prompts still direct privileged or state-changing actions.