defectdojo

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow uses DefectDojo API/MCP tools to query vulnerabilities, manage findings, and inspect security scan data, which can include untrusted vulnerability reports and findings containing outsider-authored free text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains a Python API example in references/api-v2-reference.md on line 23 which references an API token: 'Authorization': 'Token c8572a5adf107a693aa6c72584da31f4d1f1dcff'. This string is 40 characters long, composed of hexadecimal characters, and represents a real high-entropy API token. All other instances of API keys are placeholders (e.g., your-api-token, <api-token>).