picqer-webhooks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that embed API keys and webhook secrets directly in curl commands and JSON and passes secrets as function parameters, so an LLM used to fill in real credentials would need to output those secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow ingests the outsider-authored HTTP request body from Picqer (raw inbound webhook payload), parses it, and thus that free-form JSON text becomes available in the handler context (e.g., via req.body / request.body() / request.text()).