ce-proof

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs extracting and embedding access tokens/owner secrets in URLs, curl headers, and echoed outputs (e.g., ?token=xxx, x-share-token: $TOKEN, accessToken/ownerSecret), which requires the model to handle and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context when the workflow “Review a Shared Document” reads a Proof doc’s markdown via GET /api/agent/{slug}/state (or Accept: text/markdown on /d/{slug}?token=...), where the document body and comments may have been authored by other people.