deploying-honeytokens-and-canarytokens

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt contains multiple examples that embed API keys, webhook tokens, AWS secrets, and a plaintext AD password directly into commands, environment files, and download URLs—patterns that would require an LLM to handle or output secret values verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/agent.py, the agent ingests free-text memo (user-provided) when calling POST {base_url}/generate and then sends/records it, so outsider-authored text can reach the Canarytokens workflow at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's deployment instructions explicitly direct cloning and running the thinkst canarytokens Docker repository (https://github.com/thinkst/canarytokens-docker), which fetches remote code and is executed via docker compose, making it a runtime external dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating an Active Directory user account, planting decoy credentials in system locations like ~/.aws/credentials and /etc/hosts comments, and bringing up a self-hosted service that binds privileged ports — all of which modify host/system state and can require elevated privileges.