dt-obs-ios

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks the user for DTXApplicationID/DTXBeaconURL (and accepts pre-filled values) and instructs the agent to embed those values verbatim into plist contents and command invocations, which requires the LLM to handle and output those secret/identifier values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes and embeds the SPM package URL https://github.com/Dynatrace/swift-mobile-sdk.git at runtime (via the add_spm_dependency.rb script and Xcode build), which causes remote code (the Dynatrace SDK) to be fetched and executed as a required dependency in the built app.