monitor-internet-outages

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates including an API key in the X-WorldMonitor-Key header and even includes a literal-looking API key example, which encourages embedding secret values verbatim in requests/commands and thus risks secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path is a server-to-server call to GET https://api.worldmonitor.app/api/infrastructure/v1/list-internet-outages, whose response includes free-text fields like title, description, and cause sourced from Cloudflare Radar (an outsider/public provider), which the agent will ingest into LLM context.