gh-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflows explicitly fetch and parse public, user-generated GitHub content (e.g., via gh api, gh repo clone, gh gist view, gh search, and the "Bulk Operations" example that pipes gh issue list --json ... --jq to xargs to close issues), so the agent would read untrusted third-party pages/data and use those results to drive subsequent commands.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt includes installation and configuration commands that use sudo and modify system files (e.g., writing to /usr/share/keyrings and /etc/apt/sources.list.d) and suggests insecure auth/storage options, which would cause an agent to change the host system state if executed.