code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md Default Behavior explicitly says "If the user provides a pull request number or link, use gh pr diff <number> to fetch changes", meaning the agent will fetch and read arbitrary GitHub PR content (public/user-generated) and act on it as part of the review workflow, allowing indirect prompt injection.