ai-quality-assurance

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes an example that embeds an API key directly in code (client = openai.OpenAI(api_key="sk-YOUR_API_KEY")), instructing the user to substitute their secret key verbatim, which encourages handling/outputting secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md descreve um workflow que captura user_prompt e bot_response via webhook (provenientes de mensagens de usuários/terceiros) e então envia esse texto para uma API/LLM avaliador, meaning outsider-authored free text is ingested into the agent’s LLM context at runtime through the webhook payload.