baoyu-infographic

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires preserving all source data verbatim and then assembling that verbatim structured content into prompt files that are passed to an external image-generation call, so any secrets in user-provided content would be reproduced and transmitted exactly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the “Infographic Generator” workflow, Step 1.2 “Analyze Content → analysis.md” ingests user-supplied source text via source.md (file path or paste) and later Step 2 copies it verbatim into structured-content.md, meaning outsider-authored free text directly reaches the runtime LLM pipeline.