ping-orchestration-ios-sdk

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks for configuration values (clientId, redirectUri, discoveryEndpoint, serverUrl and even a Journey export JSON) and explicitly instructs substituting those user-supplied values verbatim into generated code/files, which forces the LLM to output any credential-like secrets the user provides.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime ingests outsider-authored free text when the user pastes/attaches a Journey export JSON (wizard Step W1b / create-sample Step 2), and the agent then parses that JSON into LLM-readable prose/context for “Journey Export Analysis.”