finish

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill explicitly reads and acts on user-generated GitHub content (e.g., "If the repo is public: scan the PR title, body, and commit messages" and uses gh commands like gh pr checks, gh pr create, and gh run view to fetch CI logs), and those public PR descriptions/commit messages/CI logs are ingested and used to make blocking decisions (push/merge/dispatch fixes), creating a clear path for indirect prompt injection.