babysit-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text from GitHub PR discussion content—specifically issue_comment.body, pulls/<pr_number>/comments bodies, and pulls/<pr_number>/reviews bodies by other authors—is fetched at runtime via gh api in fetch_new_review_items() / normalize_*() and then included in the emitted watcher snapshot (which the agent consumes), creating an indirect prompt-injection path through scripts/gh_pr_watch.py → new_review_items → LLM context.