agent-worker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow/setup explicitly runs shell commands like gh pr diff and captures their output into variables that are interpolated into the kickoff message (e.g., ${{ diff }}), meaning agents will ingest GitHub PR diffs or other externally fetched, user-generated web content and act on it as part of the workflow.