performing-paste-site-monitoring-for-credentials

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's workflow and code explicitly extract credential matches (including "samples") from pastes and writes/sends alerts (and the GitHub monitor builds Authorization headers using a provided token), which requires including secret values verbatim in saved output or requests and therefore creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow fetches public paste content from Pastebin via requests.get(self.SCRAPING_URL) and then requests.get(self.RAW_URL, params={"i": paste_key}), and the returned free-form paste text (resp.text) is passed into analyze_paste(content, ...) for LLM-relevant processing (outsider-authored paste bodies).