performing-web-application-scanning-with-nikto

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that embed plaintext credentials directly in command lines (e.g., -id admin:password), which instructs revealing secrets verbatim in generated commands and is an insecure pattern that risks exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly runs Nikto against arbitrary targets supplied via targets.txt or CLI (see scripts/process.py and scripts/agent.py) and parses Nikto XML/stdout and SKILL.md workflow steps (including CI/CD "Block Deploy" on findings), so it ingests untrusted public web content and uses parsed descriptions to classify findings and drive decisions.