automation-sandbox-post-copy-config-generate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt explicitly instructs the agent to embed credentials/secrets found in SOP URLs verbatim into the generated JSON output ("Embed them verbatim — the tool consumes the value as-is — but flag in the response so the user is aware the JSON now contains a secret").

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow processes customer-supplied SOP documents and files in various formats (PDF, xlsx, csv, docx, Markdown, images), which constitute outsider-authored free text ingested at runtime.