porting-codebases

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The hard rule "preserve ... embedded literals verbatim" (R1) requires reproducing any string literals from the source exactly, so if those include API keys, tokens, or passwords the LLM must emit them verbatim, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). During Phase 2, the workflow reads the source files and per-module PORTING.md/FINDINGS.md from the target directory provided by the user, and it also dispatches the reviewer prompt plus those file contents to a fresh-context subagent, so outsider-authored free text is ingested via user-controlled repository files.