steam-gaming-companion

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to include user API keys/secrets (STEAM_API_KEY, IGDB_CLIENT_ID/ACCESS_TOKEN and client_secret) directly in API requests and curl commands, which requires the LLM to insert secret values verbatim into generated requests/commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow ingests outsider-authored free text from public APIs fetched at runtime—e.g., Steam store API fields like short_description / detailed_description (and IGDB summary) and embeds that into the agent’s LLM response context as {summary}, {short_description}, and {description} (Feature 2/6 response formatting).