newskill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires executing embedded snippets "placeholders filled with real values" and "output quoted in-session," which forces the agent to inject and display real credentials or tokens verbatim, creating a direct exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document instructs automated execution of embedded skill snippets (executing arbitrary bash lines with real values, fetching external endpoints, and reading local paths), which enables remote code execution and data exfiltration from authored skill content and can be abused as a backdoor.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow reads and executes the new skill’s embedded snippets (bash/API calls and referenced file paths) during “Pre-flight the body's snippets,” which can ingest outsider-authored free text from external web/API sources or downloaded files into the agent’s LLM context via those fetched content paths.