track-military-flights

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt includes a literal-looking API key value in its docs (wm_0123456789abcdef0123456789abcdef01234567), which encourages or requires the model to handle or reproduce a secret verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow is a server-to-server call to GET https://api.worldmonitor.app/api/military/v1/list-military-flights, whose response is ingested as JSON flight/cluster data (free-text fields like callsigns/operator names) into the agent context; since the content is derived from publicly visible ADS-B sources and not authored by the operating user, it is outsider-authored free text at runtime.