litellm

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt embeds literal secret-like values (e.g., "sk-1234" and a DB URL with user:pass) in example commands, which requires the LLM to reproduce or handle secrets verbatim and is therefore high-risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). LiteLLM’s required runtime workflow exposes an OpenAI-compatible proxy API (/v1/chat/completions, /v1/models) that directly ingests outsider-authored free text from API request bodies (e.g., the chat prompt/messages) and forwards it to downstream LLM providers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The Quick Start invokes a remote Docker image (docker.litellm.ai/berriai/litellm:main-stable) via docker run, which fetches and executes remote container code at deployment/runtime, so this URL results in executing externally-hosted code.