conventions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is ingested via the GitHub Actions runtime environment variables ISSUE_TITLE and ISSUE_BODY sourced from github.event.issue.* (issue content authored by a non-operating user) and then passed into the agent context when running claude.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow includes runtime installation/execution of external code — e.g., uses: actions/checkout@v4 (a GitHub Action fetched and run at runtime) and npm install -g @anthropic-ai/claude-code which downloads and installs the remote claude CLI that is then executed — so the skill relies on fetching and running external code during runtime.