igrantio-dcql-trusted-authority

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt explicitly instructs running an "integrator intake" that asks for an "API key" (along with tenancy, backend host, webhooks, etc.), which requires the agent to solicit and handle a secret value and risks that it be included verbatim in outputs or commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The DCQL presentation definition includes a trusted_authorities value pointing to https://raw.githubusercontent.com/EWC-consortium/ewc-trust-list/refs/heads/main/EWC-TL.xml which the verifier/OWS would fetch at runtime to decide whether to accept credentials, so remote content directly controls verification decisions.