release

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The workflow explicitly instructs retrieving secrets (passwords, OTPs, and an NPM token) and embedding them verbatim into commands (e.g., --otp=, piping "$PASSWORD", and setting NPM_CONFIG_TOKEN=), which requires the LLM to handle and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md’s changelog generation runs gh pr view <number> --json title,author,number,url ..., which fetches outsider-authored PR metadata (titles/authors/URLs) from GitHub at runtime and injects it as free text into the agent’s LLM context.