address-pr-comments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested via GitHub PR review thread and comment bodies fetched at runtime through gh api graphql into /tmp/pr-${pr_number}-fetch-raw.json, then into the LLM context when the agent “shows a queue” and “investigates” by reading those bodies.