qa

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to take returned signed upload URLs/headers and paste them "verbatim" into curl PUT commands (and similar curl usages), which forces the LLM to handle and emit sensitive signed URLs/headers/tokens directly — an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly endorses using a "dev-login backdoor" to bypass normal auth (a deliberate backdoor usage) and includes scripted network uploads (curl PUTs to signed URLs) which could be abused for exfiltration if misused or redirected.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes: Phase 0 fetches the Linear issue body/description and acceptance criteria (outsider-authored) via mcp__plugin_linear_linear__get_issue, then later Phase 1/2 parses and uses that free text as input to the agent’s LLM reasoning and reporting.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime curl that downloads a test-plan from "<test_plan_attachment_url>" and then instructs the agent to read/use that file to drive its QA decisions, so an external URL fetched at runtime can directly control the agent's behavior.