api-docs-quality-report

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires extracting and embedding full page content and OpenAPI blocks (examples, headers, request/response bodies) verbatim into the generated HTML report, so any secrets present in the docs (API keys, bearer tokens, cookies, example passwords) would be reproduced in the output — an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill fetches and parses arbitrary outsider-authored API documentation pages discovered from a user-supplied docs URL (public web content), and it ingests their readable prose and inline OpenAPI blocks into the agent’s LLM context during Steps 1–3.