model-debugging

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains literal API tokens and instructs embedding tokens in commands (curl -H "Authorization: Bearer ...") and shows extracting/storing secrets (sops/jq), which forces handling or verbatim inclusion of secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow’s runtime path queries Cloudflare Workers Observability/Tinybird for “raw error events with full details” (including error/message fields from real user requests) and uses them to analyze backend/model failures, so outsider-authored prompt/input text can be ingested via stored logs/events.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the files for high-entropy, literal credentials. I found a long JWT-like Tinybird token included inline (not a placeholder). This string is high-entropy and appears to be a usable token (even if described as "public read-only"), so it meets the definition of a secret and should be treated as exposed credential.

I ignored examples and placeholders such as "sk_" mentions, environment variable names (AZURE_, CLOUDFLARE_), file paths (.tinyb, SOPS usage), and scripted token lookups (jq/sops commands) because they do not contain actual token values.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit commands that use ssh + sudo to read/modify service files and secrets and to restart systemd services (e.g., sudo journalctl, sudo systemctl restart, scp of .env), which modify the machine's state and require elevated privileges.