performing-access-recertification-with-saviynt

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt's example code assigns an API token string (SAVIYNT_TOKEN = "your-api-token") and uses it directly in Authorization headers, which encourages embedding and outputting secrets verbatim in generated code/requests.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The workflow includes “Certify with justification (free text)” and “Revoke with reason” during the campaign review, meaning outsider-authored certifier justification/reason text (from managers/app owners not chosen by the operating user) can be ingested into the system and then into the agent’s LLM context if the agent reads/uses those decision fields at runtime.