execute-fleet

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires embedding the full task JSON inline into worker prompts (and passes that prompt verbatim to spawned sessions), which forces any secrets present in tasks.json or task payloads to be emitted/verbatim-copied by the LLM; it also references a token and warns against printing it, indicating secret material is in-scope.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the runtime calls mcp__atlas-launcher__inbox_read and directly consumes terminal worker messages (free-text payloads like statuses) produced by workers, which are influenced by outsider-authored content via their submitted task prompts.