code-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires reviewers to "quote the exact code" and post inline comments/code suggestions (e.g., via gh pr comments), which would reproduce any secrets present in the diff verbatim in the LLM's output, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill explicitly ingests user-generated repository/PR content — e.g., "the branch diff", "PR title/description", and commit messages via git/gh commands (Phase 1 and Phase 2) — and reviewers are required to read and act on that untrusted content, so it could carry indirect prompt-injection instructions.