deep-read

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates extracting claims with verbatim supporting quotes from the source, so any API keys, tokens, cookies, or passwords present in the document would be reproduced exactly in the output, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via Step 1/2/3 when the operating user supplies an external document (e.g., a URL fetched at runtime or a downloaded/forwarded file) that is read into text, chunked, and then each chunk’s text is provided to per-chunk subagents for claim extraction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill's fetch_prompt injects arbitrary source["url"] values into runtime prompts and instructs "Use WebFetch to retrieve the page content", meaning external URLs provided at runtime are fetched and their raw content is fed into the model context (i.e., the fetched page at source["url"]), which directly controls the agent's outputs.