reading-portolan

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows setting S3 credentials via DuckDB SET statements (s3_access_key_id / s3_secret_access_key), which encourages placing secret values verbatim into commands/SQL and thus requires the LLM to handle/output secrets directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the “Workflow: Answering Questions About a Catalog”, the agent crawls/reads a user-provided Portolan catalog (via catalog.json and collection.json) and then fetches llms.txt and assets such as Parquet/STAC metadata from the catalog, which are outsider-authored free-text files/content within the catalog.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The HTML examples load and execute remote JavaScript at runtime (e.g., https://unpkg.com/maplibre-gl/dist/maplibre-gl.js, https://unpkg.com/pmtiles/dist/pmtiles.js, and https://cdn.jsdelivr.net/npm/potree-core/dist/potree.js), which the skill's visualization examples rely on as required runtime dependencies.