pp-uk-train-goat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that place credentials inline in shell commands and shows copying/printing API tokens (e.g., inline NR_OPENDATA_USERNAME/NR_OPENDATA_PASSWORD and export LDBWS_API_TOKEN), which are patterns that can cause an LLM to emit secret values verbatim and therefore present an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow uses the CLI to fetch and process live/free-form text from National Rail OpenLDBWS/Open Data (e.g., delay/cancel reasons and operator alerts that populate messages[]), which the agent then ingests as tool output into the LLM context—indirect prompt injection risk from outsider-authored upstream content.