codebase-to-course

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.85). The skill explicitly requires embedding "actual code snippets" and inspecting config/deployment files (including API handlers and authentication) without instructing redaction, so it can force the LLM to reproduce secret values from the codebase verbatim (API keys, tokens, passwords) and thus enables secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow ingests the target codebase’s README/config/entry points and other source text (e.g., via cloning a user-provided GitHub repo URL), and that repository content is outsider-authored free text that can be embedded into the generated course/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs cloning a user-provided GitHub repository at runtime (e.g., https://github.com/zarazhangrui/codebase-to-course), which fetches remote code that will be injected into the agent's context and used to drive prompt/content generation, so this is a runtime external dependency that directly controls the agent's outputs.