skills-management

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to accept user-provided credentials and "write the values to the environment variable file in the workspace," which requires the LLM to handle and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path scripts/skills_download.py/scripts/skill_list.py uses list_skills_by_space_id and then downloads/extracts TOS objects (zip_path) for skills listed in the remote skill spaces; since the workflow ingests skill metadata/zip contents coming from the skill space owner (potentially outsider-authored), it is exposed to indirect prompt injection via that fetched text/artifacts.