railway-to-createos

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to provide environment variable VALUES and instructs the agent to call the MCP API to set them (requiring the LLM to handle/send secret values verbatim), and it shows an example mysqldump command with a password on the command line.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md “Step 1: Inventory the Railway project” the workflow reads repository files (e.g., railway.json/railway.toml/Dockerfile/.env* and Procfile), which are user-supplied free text from the target GitHub repository at runtime rather than first-party trusted content.