credential-guardian

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md and rotation-playbook explicitly instruct running curl against public third-party APIs and sites (e.g., api.kie.ai, generativelanguage.googleapis.com, aitable.ai, api.resend.com, api-m.paypal.com and public health endpoints) and requires interpreting those responses to decide rotations/health actions, meaning untrusted external content can influence agent decisions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs connecting as root via SSH, editing system-level files (e.g. /opt/superseller-worker/.env), running deploy scripts and token-refresh commands — all actions that modify machine state and require privileged access.