nylas

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that pass API keys and plaintext passwords directly (e.g., nylas auth config --api-key nyl_xxx and the expect script with "YOUR_PASSWORD"), which instructs embedding secrets verbatim in commands/scripts and therefore requires the LLM to handle/output secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for this skill is reading/summarizing emails via nylas email read / nylas email ai summarize <message-id>, which ingests the body text of emails authored by other people (outsider email content) into the agent/LLM context.