proof

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to extract share tokens/accessTokens from URLs and embed them verbatim into curl commands and outputs (e.g., echoing tokenUrl, using -H "x-share-token: xxx"), which requires the LLM to handle secrets directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly directs the agent to fetch and read shared documents from the public endpoint https://www.proofeditor.ai/api/agent/{slug}/state (Proof URLs like https://www.proofeditor.ai/d/abc123?token=xxx), which are user-generated/untrusted markdown that the agent must interpret and then take actions (comments/suggestions), creating a clear path for indirect prompt injection.