collect-evidence

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires preserving and returning all raw content from PRs, git notes, Slack/Notion pages, and other sources, so any secrets present in those sources would be captured and emitted verbatim in the Evidence Bundle, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and parses user-generated PR comments to extract an Evidence Bundle manifest (Step 1) and then uses identifiers from that manifest to fetch external user content (GitHub review comments, Slack threads, Notion pages, Linear issues, etc. in Steps 2–7), meaning untrusted third-party content is read and can directly influence which tools/requests the agent performs, enabling indirect prompt injection.