summary-user-said

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly hands unsanitized original message text to the Agent and writes a .messages.md with raw user content, so any secrets present in the messages would be read by the LLM and output verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 在 scripts/run.py 产生 to_agent 断点后，Agent 运行时会从 scripts/nodes/agent_summary.py 的 brief.allowed_path=collection["messages_path"] 读取脚本筛选后的 messages.jsonl（其中包含用户 role=user 的文本，可能包含恶意注入内容）。