end-to-end-leadership-change-signal

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly asks the user to "provide key" for Apollo and includes a code snippet that injects an api_key into an API payload, which requires the agent to accept and embed a secret value (risking verbatim exposure/exfiltration).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—Step 1 “Discover Leadership Change Signals” runs runtime web/tweet/HN/Reddit/LinkedIn scraping (outsider-authored free text) and then consolidates/extracts fields that are fed into later LLM steps for relevance evaluation and outreach drafting.