engineering-loop

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The Authorization boundary requires the agent to "hand[] to the user as an exact command, even when you hold the credentials," which implies the agent must embed or transcribe credentials into output so the user can run that command, creating a verbatim secret-handling/exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow reads an outsider-authored GitHub issue (and later PR) body via gh issue view N, which can contain arbitrary free text from non-operating users that may be injected into the agent’s LLM context.