track-vessel-traffic

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates including an API key in the X-WorldMonitor-Key header and even shows a literal-looking key in the prompt, which encourages embedding secret values verbatim in generated requests/commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path is a server-to-server call to GET https://api.worldmonitor.app/api/maritime/v1/get-vessel-snapshot, whose response (AIS vessel snapshot/candidate overlays) is ingested as readable JSON text into the agent context; this content is authored/provided by an external third-party service (WorldMonitor), not by the operating user.