review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches PR metadata and diffs from GitHub (e.g., gh pr view $PR_NUMBER, gh pr diff $PR_NUMBER) and injects those untrusted, user-authored files into parallel reviewer agents' scopes so the agent reads and acts on that third‑party content, enabling indirect prompt injection.