check-sanctions-pressure

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires callers to present an API key in the X-WorldMonitor-Key header (and even includes a literal example key), which means an agent may need to embed a secret verbatim into generated requests/commands, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow calls GET https://api.worldmonitor.app/api/sanctions/v1/list-sanctions-pressure, and the LLM ingests the returned JSON fields like entries[].note/name/programs/sourceLists as readable text, which is outsider-provided dataset content (not authored by the operating user or their org).