mt5-backtest

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains an explicit broker password (Ready@123) and instructs saving/including that password verbatim (credentials.env, generated [Common] with Password=, and passing as a CLI arg), so an LLM following these instructions would need to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow instructs the agent to read and parse MT5-generated report/CSV/log outputs (e.g., {EA}_report.md and tester logs) at runtime, which are outsider-authored free text because they originate from the executed EA/MT5 backtest environment rather than the operating user’s own prompts/files.