observability-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The MCP example explicitly includes fields like "api_key: [datadog_api_key]" and the prerequisites call out "API keys or webhook credentials", which requires the agent to insert secret values verbatim when creating connector records.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow reads potentially outsider-authored free text from the ServiceNow tables em_event and em_alert (e.g., Step 5 “Validate Incoming Events” queries em_event.description, and Step 6 queries em_alert.description), where those fields contain payload/alert content ingested from external observability platforms.