dependency-vulnerability-triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill runs npm audit (--json) in scripts/parse-audit.ts and invokes Snyk in .github/workflows/security-audit.yml, ingesting public npm/Snyk advisory data (untrusted third-party content) which it parses and renders into patch plans and PR comments, so the agent directly reads and displays third‑party content that could carry injected instructions.