meccha-chameleon-game-cheat-detection

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's analysis code explicitly extracts password strings from repository README content and includes them in findings and generated warning responses, which would cause the LLM to output secret/password values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s required workflow is to analyze a target repository’s README/content (e.g., via runtime fetching/parsing of external repo text), which would ingest outsider-authored free-form README/body text from the target repository into the agent’s LLM context (indirect prompt-injection risk).