autoreview

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly states it writes and scans the exact outgoing review pack and "credentials are never redacted and forwarded", and it requires an AMP_API_KEY to be supplied to the helper, which forces secrets to be included/unredacted in prompts sent to reviewer engines—meaning the LLM would receive and forward secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The autoreview runtime (e.g., scripts/autoreview with --mode branch/commit/local) ingests outsider-authored free text by reading the repository diff/patch (including untracked file contents and optional --prompt-file/--dataset) directly into the LLM prompt via build_review_prompts/render_review_prompt.