a6-plugin-ai-prompt-template

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes literal bearer-token examples ("Authorization: Bearer sk-your-key") in multiple config examples, which instructs embedding secret values verbatim in request headers/configuration and therefore requires handling/outputting secrets directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill “ai-prompt-template” replaces {{variable}} placeholders using client request fields (runtime request JSON), so outsider-authored free text from the client (e.g., code, language, text) is inserted into the LLM prompt context after substitution.