prime-sweep

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The protocol requires sub-agents to return verbatim quotes (≥8 words) or verbatim-tokens for identifiers/versions/numerics and the lead to include source:line excerpts in its emit, which forces the LLM to handle and potentially output secret tokens or passwords present in source material verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via the “all other sources” path in Step 6—sub-agents may ingest in-context dumps/out-of-context dumps/search results/MCP results/conversation excerpts, which are explicitly treated as ephemeral sources and then materialized with Write+Grep (i.e., readable text originating outside the operating user can be processed and thus can influence the agent’s context).