security-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires reading changed files and returning "Current code" snippets and exact file ranges in the final report, which will force the model to reproduce any hardcoded API keys, tokens, passwords, or other secrets present in those files verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow reads changed files from the repository (e.g., via git diff ... --name-only and then “read every changed file completely”); those files are outsider-authored when the PR/branch includes text written by someone other than the operating user (e.g., public PR author), and that file body becomes LLM-readable context for the review.