check-chokepoint-status

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates including an API key in the X-WorldMonitor-Key header and even embeds a literal API-key-like string in the docs, which encourages the model or agents to handle and possibly output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required workflow calls GET https://api.worldmonitor.app/api/supply-chain/v1/get-chokepoint-status and directly ingests the first-party API response fields (including activeWarnings/description/etc.) which may contain text originating from external sources, without any prerequisite user selection.