record

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs recovering and quoting prompts "exactly" and to include a delegation prompt verbatim, which can force the LLM to reproduce API keys, tokens, or other secrets that appear in those prompts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads outsider-authored free text from the user/creator’s local agent history when it “searches that agent’s history by content” to recover and then quotes the exact prompt (e.g., references/shared/prompt-recovery.md steps 2 and 3), which attacker-controlled text can influence.