ai-wife

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt's examples show Authorization: Bearer {{YOUR_TOKEN}} used directly in curl commands, effectively instructing the agent to insert and emit API tokens verbatim in requests/commands, which is an insecure secret-handling pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill’s SKILL.md shows the agent fetching and acting on public, user-generated profiles and narratives from https://inbed.ai (e.g., the /api/discover endpoint and chat/messages responses), which the agent is expected to read and use to make swipes, messages, and relationship decisions—allowing third-party content to influence actions.