launch-with-aws

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill requires the agent to display and relay verbatim authentication URLs and a full download URL (e.g., signInUrl and download_url), which can be sensitive/pre-signed values and therefore forces the LLM to output secret-like values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source code text from outsider-authored repositories is ingested when the workflow runs create-launch with a user-provided GitHub URL (cloned server-side) or a user-provided local directory that is zipped and uploaded, and the backend then analyzes/refines/plans based on that content.