issue-intake

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires preserving commands and environment variables verbatim and writing raw signal content into the backend, which forces the agent to include any embedded secrets (API keys, tokens, or passwords) verbatim in its generated output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md:52-53 and :59-60 require the agent to read and preserve an explicitly presented external PR’s author/description/URL/check status and diff-observable behavior into the work record body, which is outsider-authored free text (PR content) ingested at runtime into the agent’s LLM context.