find-icp-companies-with-active-pain-points-and-the-people-involved

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to collect and use an API key/OTP (writing the returned api_key and user id into .env and including the key in authenticated requests), which requires handling and embedding secret values verbatim in requests/commands (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill calls the OpenFunnel API (e.g., POST /api/v1/signal/ and POST /api/v2/account/batch against https://api.openfunnel.dev) and is explicitly instructed to present and act on the returned "inline signal content", accounts, and people — data that derives from public/user-generated signals — so untrusted third-party content is ingested and can drive subsequent actions (deploys, CRM syncs, tool use).