track-conflict-events

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows a raw API key value and requires callers to put an API key in the X-WorldMonitor-Key header, which encourages the LLM to include secret API keys verbatim in generated commands or code (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path is a server-to-server call to GET /api/conflict/v1/list-ucdp-events, which returns UCDP-sourced event fields (e.g., location, sideA/sideB, sourceOriginal) that are outsider-authored public dataset content ingested into the agent’s LLM context as readable JSON.