cekura-flag-call-log-failures

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires including verbatim transcript "evidence_quote" snippets and "verbatim evidence" in outputs, which forces the LLM to reproduce whatever sensitive data (PII, passwords, tokens, etc.) appears in call transcripts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md requires reading production call logs and—at least for heuristic candidates (e.g., silence/timeout, abnormally long calls)—fetching full per-call transcripts via mcp__cekura__call_logs_list/mcp__cekura__call_logs_retrieve, where transcript text is generated by external callers and thus constitutes outsider-authored free text ingested at runtime.