vhs-terminal-recordings

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows examples that embed API keys directly in tape commands (e.g., Type "export API_KEY=xxx" and Type "export ORTHOGONAL_API_KEY=orth_live_xxx"), which requires the agent to include secret values verbatim in generated output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md and references/examples.md include tape examples that run CLI scraping commands against arbitrary public URLs (e.g., "orth run olostep /v1/scrape url=https://news.ycombinator.com" and "url_to_scrape=https://example.com"), so the recorded workflow consumes and displays untrusted third-party web content as part of its runtime demo flow which could influence subsequent actions.