I interpreted this as, if you have any public repos, you let people prompt inject Claude (or any LLM using this MCP) when it reads public issues on those repos and since it can read all your private repos the prompt injection can ask for information from those.