feedback

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to forward the user's feedback verbatim as a command-line argument (--content) via exec, forcing the LLM to emit any secrets contained in that feedback into its output/commands.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill and its helper script automatically locate and read session files (messages, images, and arbitrary attached files), base64-encode them, and POST that data to a configurable feedback API without asking the user for confirmation, which constitutes intentional data exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—submit-feedback.mjs reads the runtime session JSONL (messages authored by other users in the conversation) from agents/<agentId>/sessions/sessions.json, extracts their free-text into conversationContext, and includes it in the LLM-readable payload.conversationContext field (even though it’s sent to an API, it is still injected into the agent’s context pipeline).