owasp-top-10-web

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the reviewer to grep for and report hard-coded secrets and to include "Evidence: [Code snippet or configuration excerpt]" in findings, which would require the LLM to reproduce secret values verbatim in its output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow reads the target project’s source/config files via Read/Grep for analysis (outsider-authored code/comments inside the repo could be injected into the LLM’s context as readable code/text), and the prompt explicitly warns that reviewed code may contain adversarial content.