plan-feature

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires inserting the exact $ARGUMENTS value verbatim into multiple agent prompts and generated plan files (and into tool calls), so if that argument contains API keys, tokens, or passwords the LLM will reproduce them in its outputs — a direct secret-exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow ingests the user-provided feature description ($ARGUMENTS) into agent prompts (“replace [feature description] with the exact $ARGUMENTS value”), and that text is outsider-authored free-form input from the operating user’s chat; it is not a vetted internal file or bundled reference.