track-tariff-trends

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires presenting an API key in the X-WorldMonitor-Key header (and even includes a literal example key), so an agent generating requests or curl commands may need to insert secret values verbatim into outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow calls the WorldMonitor API endpoint GET https://api.worldmonitor.app/api/trade/v1/get-tariff-trends, and the agent will ingest the JSON response body (e.g., datapoints, effectiveTariffRate, fetchedAt) as LLM-readable text; this is outsider-provided data fetched from a third-party service rather than user-authored content.