sentry-pr-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches GitHub PR comments via gh api repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments (Phase 1), parses user-generated comment body fields including the "AI Prompt" and "Suggested Fix" blocks (Phase 2), and then instructs the agent to implement fixes using those parsed suggestions (Phase 3), which means untrusted third-party PR comments on GitHub can directly influence tool actions and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill calls the GitHub API at runtime (gh api repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments -> https://api.github.com/repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments) to fetch Seer-by-Sentry comments that include an "AI Prompt" block which would directly inject and control agent instructions.