pr-vet

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The https://github.com/ URL is a well-known, generally trusted host, but the entry "https://registry\" is malformed/escaped and likely indicates an off-registry/obscured or typosquatted package source (a common malware vector), so the set includes a suspicious download reference.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). SKILL.md Step 0 instructs the runtime workflow to fetch outsider-authored PR title/body/comments/commit messages and author profile text via gh pr view/gh api, write it to /tmp/pr-text.txt, and then the vetting agent uses that text for analysis—so attacker-controlled free text is ingested into the LLM context (even if the prompt says to isolate it in a sub-agent).