render-debug

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes templates and commands that instruct replacing <YOUR_API_KEY> (e.g., embedding "Authorization: Bearer <YOUR_API_KEY>" in config and CLI commands) and says "Always use their API key," which could require the LLM to accept and emit secret API keys verbatim into configs/commands—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md the required debugging workflow uses Render MCP to read build/runtime logs via list_logs(...) for a serviceId discovered with list_services(), and those logs can contain app/user-supplied text that an outsider could influence (medium injection risk via indirect log content ingestion).