workflow

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The runner explicitly embeds resolved inputs and prior step outputs (which can contain API keys or passwords) into subagent prompts and instructs the agent to convert the JSON args into space-separated key=value pairs for a Skill-tool invocation, forcing the LLM to include secret values verbatim in its output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runner reads the user-supplied workflow YAML from a runtime path via Read/open(path).read() in Phase 2, and that YAML is outsider-authored free text (the operating user did not author the workflow content themselves), which is then parsed and used to construct LLM prompts for subagents.