review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill fetches and reads user-generated PR data from GitHub (e.g., via gh pr view $0, gh pr diff $0, reading the PR body including the "## Test plan", and the changed files), and it also executes test-plan steps from that untrusted content, which could allow indirect prompt or command injection.