issue-flow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly reads GitHub Issue bodies and comments using commands like gh issue view <N> --json ... (Phase 0 step 3, Phase 2c and references/recovery-guide.md), and then interprets that user-generated Issue/comment content to drive planning, tasking, and automated actions, which exposes the agent to untrusted third-party input that could perform indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly calls the GitHub API at "gh api repos/{owner}/{repo}/issues//comments" at runtime to fetch issue comments (including the technical plan) and then reads/uses that fetched comment content as the technical plan provided to spawned agents, meaning remote content directly controls agent instructions.