review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to include the full git diff and per-file/hunk content in sub-agent prompts and verbatim reports, so any secrets accidentally present in the repo diffs would be ingested and likely reproduced in output, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The workflow ingests outsider-authored free text when it fetches remote issue/PR tracker content (e.g., GitHub/GitLab issue bodies) via docs/agents/issue-tracker.md in step 2.3, and then passes that fetched text into the Spec sub-agent’s LLM context.