sentry-pr-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's Phase 1 explicitly fetches GitHub PR comments via the gh API (repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments) and Phase 2 instructs the agent to extract the "🤖 Prompt for AI Agent" block from those (user-generated) PR comments and use it when verifying/fixing code in Phase 3, which clearly exposes the agent to untrusted third-party content that can influence its actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls the GitHub API via "gh api repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments" at runtime to retrieve Sentry bot comments that include a "🤖 Prompt for AI Agent" block which would be injected as instructions to the agent, so external content directly controls prompts.