experience-content-media-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the agent to confirm and apply the complete image URL including all query parameters (which may contain authentication tokens), forcing the LLM to output potentially sensitive token values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). This skill ingests only the user’s own free-text query/selection to perform a provider-backed image search via tools like search_media_cms_channels or search_electronic_media, and the workflow explicitly requires user selection before any tool is called (no monitored outsider text streams like email/chat/issue bodies are described).