oma-recap

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill reads full conversation history and embeds prompt text (via .display and the recap output) into saved Markdown recaps, so any secrets present in those histories would be reproduced verbatim in the generated output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime path “Collect Data” ingests outsider-authored free text from public/third-party sources via oma recap --json (conversation history fetched/compiled from other tools’ logs) and, if the CLI is unavailable, from ~/.claude/history.jsonl (Claude chat transcripts authored by non-operating-user participants), which is then read and summarized into the agent’s LLM context.