security-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires including "short snippet of the vulnerable code" from changed files in the final report (and to read all changed files), which forces the agent to reproduce any hardcoded secrets or credentials found in those files verbatim in its output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime workflow reads changed files from the repository via git diff ... --name-only and then “read every changed file completely,” so if those changed files contain outsider-authored free text (e.g., PR/issue/wiki/discussion content), that prose is ingested into the agent’s LLM context for analysis.