distribb

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to have the user "copy its Integration Key, and send it here" and shows a curl body with "integration_key": "", which requires the LLM to accept and emit a secret value verbatim into an API request (secret exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In the required “AI Search Visibility & Listicle Backlink Outreach” workflow, the agent uses WebSearch and WebFetch against live third-party pages/listicles to extract cited content and contact info at runtime, so outsider-authored free text from those sites can be ingested.