target-intelligence

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The setup guide instructs adding MCP servers by embedding the API key directly in the command URL (claude mcp add ... ?apiKey=...), which is an insecure pattern that requires or encourages placing secret values verbatim in commands/configuration and could lead to those secrets being output or exfiltrated.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's "Principle 5: Web Search Tool Usage" explicitly requires calling web search after MCP retrievals and integrating open-web content (e.g., ClinicalTrials.gov entries, news, public websites) into the report, so the agent will fetch and act on untrusted third-party web content that can influence decisions.