drupal-tutorial-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt asks the agent to "confirm" and then use the ddev admin username/password and shows examples that embed plaintext values into host shell commands (printf ... 'value to type' | base64 ...) which forces the LLM to handle and emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow “Read the module first” ingests the user-authored module contents (e.g., <machine_name>.info.yml, README, config forms) inside step 3 to derive setup steps, which then become beat/caption/narration text consumed at runtime.