review-loop

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires sending the full target material verbatim (including "token definitions" and surrounding context) to a fresh subagent and forbids filtering or summarizing, which forces the agent to handle and forward any secrets present in the target.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow explicitly reads the user-specified “target material” (Step 1) and then passes the full target verbatim into a spawned reviewer subagent’s LLM context (Step 2), so if that target includes outsider-authored free text (e.g., downloaded/forwarded files, issue/wiki/discussion text), it becomes injection-capable context.