ngx-ai-devtools-angular-llm-debugger

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The devtools intercepts and displays raw LLM API requests/responses (including headers and URL query strings) and offers replay, which means API keys/tokens and other secrets present in requests can be captured and shown verbatim unless explicitly redacted — requiring the tool/agent to handle secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill intercepts and displays LLM request/response bodies from runtime network calls (e.g., via fetch/HttpClient/SDKs and configured additionalEndpoints), so any outsider-authored free text included in those payloads (such as user/chat messages or upstream content) can be ingested into the agent’s LLM context through the intercepted prompt/response text.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)