local-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt contains examples and instructions that embed plaintext secrets into commands (e.g., fill "password123", instructing to copy a session_token cookie, and passing '<bluebubbles_password>' as a CLI argument), which would require the LLM to output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow for the agent-gateway probe, outsider-authored text received from the gateway WebSocket (window.WebSocket frames with operationId=) and/or direct SSE (fetch to /api/agent/stream) is parsed and stored for later analysis, meaning the probe can ingest arbitrary chat content provided by external users.