cubrid-grill-and-implement

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context when input_kind is jira or pr: the skill fetches JIRA descriptions/comments via /jira and PR body/diff via gh pr view/gh pr diff, then passes the resolved input_payload (untrusted prose/diff text) into the writer and reviewer subagents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches GitHub PRs at runtime (via gh pr view / gh pr diff) for URLs matching https://github.com/.../pull/, and it treats the PR diff/body as the required input_payload passed verbatim to writer/reviewer subagents, so remote content directly controls agent prompts.