orchestrator-pi-workflows

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly instructs the agent to read a local JS file and "pass its exact contents" as an inline script, which would force the model to emit any literal secret values contained in that file verbatim if present.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—this skill’s required GitHub-issue-to-Herdr workflow fetches the outsider-authored GitHub issue (including body/comments/links) at runtime via gh issue view, then injects it into the “GitHub issue planner” agent prompt through the LLM-readable ISSUE: {issue} / Create an execution plan for GitHub issue {issue} prompt path (indirect prompt-injection risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The workflow runtime fetches the GitHub issue at https://github.com/owner/repo/issues/123 (via gh issue view) and uses its content to drive the planner/executor prompts and plan validation, so external content directly influences agent instructions.