compose-preview-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill explicitly instructs the agent to read and cite existing PR comments (e.g., the sticky comment) and to fetch repository state from remotes (git worktree add origin/$BASE / gh pr view), which are user-generated, public GitHub content the agent ingests and uses to decide whether to re-render or post comments.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup instructs running a bootstrap installer that fetches and executes remote code at runtime via "curl -fsSL https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh | bash", and the skill explicitly depends on the compose-preview tool that installer provides.