yeet

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and parses public, user-generated GitHub repository content and search results (e.g., "gh api repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE" in references/create-issue.md and the GraphQL queries/gh search in references/create-discussion.md) and then interprets that content to choose templates, labels, categories and to generate or edit issues/PRs/discussions, so untrusted third-party text can materially influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches repository template files at runtime (e.g. via "gh api repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE/{template_name} --jq '.content' | base64 -d" and "gh api repos/{owner}/{repo}/contents/.github/DISCUSSION_TEMPLATE/{template_name}") and parses those templates to generate and populate issue/discussion/PR bodies, meaning remote content directly controls the agent's generated prompts/instructions.