xerahs-release-bump-tag

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's runtime scripts explicitly fetch and read user-generated GitHub content—using gh run view --job --log to retrieve Actions job logs and gh release view to read/edit release bodies (in scripts/run-release-sequence.sh and ensure_standard_release_notes)—and the agent is expected to inspect those logs/bodies and take remediation actions, so untrusted third-party content can influence next steps.