debuzz

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill writes the source text verbatim into a CLI invocation (agy -p "$(cat …)") and then requires returning agy's rewrite verbatim while preserving all technical facts, numbers, file paths, commands and code blocks — forcing any secrets in the source to be reproduced and output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill intentionally forwards verbatim user or assistant text to a third-party CLI/service (agy/Google) and reproduces its output, creating a high risk of exfiltrating sensitive data or secrets to an external provider.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The debuzz skill ingests user-provided free text (the optional [text] argument or the conversation’s last substantive response) into the prompt via agy -p "$(cat <scratchpad>/debuzz-input.md)", so an outsider can supply arbitrary text that the runtime LLM processes for rewriting.