rensto-asset

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds an explicit Postgres connection string (including a plaintext password) and shows it being used in command examples, which forces the agent to handle and potentially reproduce the secret verbatim — a direct exfiltration risk.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md "Contractor-count growth" and "Existing pipeline" sections explicitly instruct running Apify scrapers and Crawl4AI website verification (and pulling median costs from HomeAdvisor/Angi) to ingest and score public contractor websites and listings, so the agent will read untrusted third-party/user-generated web content that can materially affect scoring and downstream actions.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the Postgres connection string in the Pre-flight section:

PGURL="postgres://admin:4b14f16c833eff714a7204ef3df53b01@172.245.56.50:5432/app_db"

This includes a username and a high-entropy password directly embedded in a connection URI — a real, usable credential that grants DB access and should be rotated/removed.

Ignored items / why not flagged:

• UUIDs and IDs (tenantId, brandId, workspace ids like spc63cnXLdMYc) — identifiers, not credentials.
• IPs, domain names, and service names (172.245.56.50, rensto.com) — infrastructure addresses.
• Placeholders (NEXT_PUBLIC_GA_ID, references to Stripe test keys but not the keys themselves) — no actual secret values present.
• Fake/example values called out in the doc (fake phone +1-555-0123, mentions of simple passwords in the definition) — low-entropy / documented examples per rules.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs privileged, state-changing operations (SSH as root, checking/modifying systemd service files, creating a rensto user, editing nginx/system files, rotating secrets and redeploying) which require sudo/root access and would modify the machine state.