find-icp-companies-with-active-buying-windows-and-the-people-involved

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to obtain an API key via the verify flow, write it into .env, and then use that key in request headers (X-API-Key), which requires the agent/LLM to handle and embed the secret verbatim in generated requests/files.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill calls OpenFunnel endpoints (e.g., POST /api/v1/signal/, GET /api/v1/icp/list, POST /api/v2/account/batch) to retrieve “signal” results, account details and inline signal content aggregated from external public sources, so the agent will read and act on untrusted third‑party content returned by those API responses as part of its workflow (see SKILL.md Step 6 and the API Reference).