sdpm-vibe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires the agent to read user-provided source material and "include all data points, numbers, quotes, facts, technical details" in specs/brief.md (written via run_python), which would force the LLM to reproduce any secret values from the source verbatim in its outputs/files.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In VIBE mode, the runtime workflow ingests outsider-provided free text/URLs and then writes it into specs/brief.md via run_python, which the composer sub-agents later read as context (specs/brief.md is explicitly their only source of truth).