track-vessel-traffic

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill mandates including an API key in the X-WorldMonitor-Key header and even contains a literal-looking API key example, which creates a risk the LLM will output secret values verbatim when generating requests or commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow is a server-to-server API call to GET https://api.worldmonitor.app/api/maritime/v1/get-vessel-snapshot, and the LLM would ingest the returned JSON fields (including vessel lists) which are outsider-provided data from a third-party service at runtime.