wk-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). [Exclusion] The skill only consumes outsider-authored free text from the user’s task prompt to plan (and optionally reads user-provided artifacts like URLs/PRs/files mentioned in that prompt), but it does not specify monitoring/ingestion of a continuous feed/queue (e.g., email/chat/comments/GitHub issues) or any automatic reading of arbitrary externally submitted text without the user first providing specific concrete artifacts.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs at runtime to fetch GitHub comment bodies using "gh api repos/{owner}/{repo}/{pulls|issues}/comments/{id}", which would inject remote content into the agent's context and can directly influence prompts/instructions.