ad-model-onboard

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt repeatedly mandates copy-pasting "ALL raw prompts and their complete generated outputs" verbatim into reports and PR comments (including run logs), which forces the agent to include any secrets that appear in those logs and therefore creates a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly requires downloading and reading public HuggingFace model repos/cards and other web resources (Phase 0 Step 2, Phase 1 Step 2, Phase 11), i.e., untrusted third-party/user-generated content that the agent must interpret to decide modeling, registry, and run actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Flagging HuggingFace model repo fetch (e.g. huggingface-cli download {org}/{model} / https://huggingface.co//) because the skill explicitly runs huggingface-cli at runtime and relies on AutoConfig.from_pretrained(..., trust_remote_code=True) and downloaded modeling_*.py files—which means remote repo code/config is fetched at runtime, can execute or influence the agent's behavior, and is a required dependency for onboarding.