monitor-misuse

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The content describes an automated LLM-driven system that proposes and can auto-apply corrections directly to other skills' source files and includes hardcoded service credentials and local socket access, which weakens security boundaries and is suspicious without explicit malicious intent.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt injects observed "sent_value" examples into the LLM prompt and asks the model to return a "correct_value"/proposed_correction, which forces the LLM to receive and potentially emit secret or credential values verbatim (exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/analyze.py, the nightly workflow queries the misuse_events collection and directly ingests attacker-controlled sent_value strings from those outsider-submitted misuse events to construct an LLM prompt and generate JSON correction text.