agentic-actions-auditor

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to fetch workflow contents and extract env: values and fields like the GitHub AI Inference "token", and to include YAML snippets as evidence—actions that can require outputting secrets verbatim if present.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md’s required runtime workflow includes “Fetch Workflow Files” via gh api ... --jq '.content | @base64d' and then proceeds to analyze the fetched YAML content, which is outsider-authored free text from a remote GitHub repository (public/private) that the agent reads into its LLM context for analysis.