oss

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and parses public, user-generated GitHub content (e.g., via "gh api graphql" for repository discussion categories, "gh api repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE" and "gh search issues"/"gh search discussions") and uses those templates/search results to generate PR/issue/discussion text, so it directly ingests untrusted third‑party content from GitHub that could carry adversarial instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes gh api to fetch repository template files at runtime (e.g. https://api.github.com/repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE/{template_name} and https://api.github.com/repos/{owner}/{repo}/contents/.github/DISCUSSION_TEMPLATE/{template_name}), decodes/parses those templates, and injects their content into generated issue/discussion bodies—meaning remote content directly controls prompts/instructions at runtime.