pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md workflow explicitly fetches recent PRs with "gh pr list --repo toss/es-toolkit" and instructs the agent to read PR diffs, modified files, and contributor-written code/comments from GitHub (public, user-generated content), which the agent uses to drive triage, tests, and review decisions—exposing it to untrusted third-party instructions.