council

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to read filesystem, repo, and auth/security dirs and to include the gathered "Intelligence Brief" verbatim in advisor responses, HTML/Markdown outputs, and external MCP calls, so any secrets found (API keys, tokens, private keys) would be emitted and saved/sent — creating direct exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Phase 0 (Step 2) explicitly instructs the agent to pull data from MCP data sources including public/open sources such as "github (PRs, issues, recent commits)", "brave-search/tavily (market intelligence)", TimesFM, and other third‑party feeds, and that Intelligence Brief is fed to all advisors who must reference it — meaning untrusted, user-generated public content is fetched, read, and used to drive decisions and actions.