github-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflows run gh issue list and gh pr list and consume outsider-authored issue and PR titles (for example, gh pr list --json ... title and the untriaged/by-label helpers), and any outside user can open issues or PRs on the repository, so the workflow reads outsider text without the agent selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The decisive dependency is the instructed gh extension install yahsan2/gh-sub-issue, which installs executable code from an individually owned repository (unofficial but no concrete warning signs), so it is common/reputable unofficial and rated medium; the cli.github.com apt/keyring setup is official GitHub first-party and signature-enforced, so it is not reported.