testrail-bug-report

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to retrieve credentials from TestRail preconditions/notes and use them in Chrome DevTools MCP calls (e.g., mcp_chrome-devtoo_fill) which requires embedding secret usernames/passwords verbatim in generated calls.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill fetches complete TestRail case content (including title, custom_preconds, custom_steps_separated, and expected/notes) via mcp_testrail_getCase, and that case text is authored by TestRail contributors other than the operating user, which then gets formatted into the LLM context for bug-report generation.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)