differential-review-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to capture environment variable values and a "token" field and to include YAML "Evidence" snippets and line-referenced data flow steps, which can cause literal secret values (tokens/passwords) present in workflow files to be extracted and output verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill performs remote analysis by fetching arbitrary GitHub workflow YAML content via gh api repos/{owner}/{repo}/contents/... (Step 0) and then reads it for AI action discovery (Steps 1-4), so an outsider can supply poison text by hosting it in the analyzed repo.