wxt

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's content script (entrypoints/content.ts) injects into public GitHub pages ("://.github.com/*") and reads PR diffs (document.querySelector('.diff-view')?.textContent), which are sent to the background worker and used to call the OpenAI API and drive responses, so untrusted third‑party page content directly influences agent behavior.