llm-wiki

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit commands that pass a password on the command line (e.g., ob login --email --password ''), which requires the LLM to handle and potentially output secret values verbatim, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's "Ingest" workflow explicitly calls out fetching URLs via web_extract into raw/articles/ and then instructs the agent to read, interpret, and use that content to create/update wiki pages (SKILL.md "Ingest" section), so arbitrary public web content can materially influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly fetches arbitrary user-provided URLs at runtime via "web_extract" (i.e., user-supplied https://… links) and injects that fetched content into the agent's context for ingestion and synthesis, which can directly control the agent's outputs.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill includes explicit privileged operations (e.g., "sudo loginctl enable-linger $USER" and global npm installs) and guidance to enable background systemd services, which encourages running commands that require elevated privileges even though it doesn't directly create users or edit system files.