permissions

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to scan session JSONL files, report uncovered Bash commands and show example commands (and then merge approved entries into settings.json) but provides no redaction guidance, so it will likely require outputting raw commands that may contain API keys or other secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Step 1/“Extract Bash Commands from Session JSONL Files” reads assistant tool_use blocks named “Bash” (free-text Bash commands) from project JSONL files created from prior sessions, i.e., outsider-authored transcript content consumed at runtime.