commit-push-sync

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and inspects upstream remote repository data (e.g., git fetch "$UPSTREAM_REMOTE" and subsequent git log ..@{u} / git log @{u}.. checks in the "Step 1: Fetch and Evaluate State" workflow), which ingests untrusted/user-generated third‑party content (remote commit history) and uses it to decide pull/push actions—allowing remote content to materially influence the agent's behavior.