add-webex

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks the user to paste the Bot Access Token and webhook secret and then uses an nc:env-set directive that will embed those values verbatim into a generated .env file, requiring the agent/LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill runtime reads outsider-authored free text from Webex message events via the shared webhook server endpoint /webhook/webex, which ingests message content posted by external Webex users.