refine-email-drafts

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to read .env to extract an API bearer token (EMAIL_DRAFT_ONLY_BEARER) and then use it directly in bash curl commands (e.g., -H "Authorization: Bearer $EMAIL_DRAFT_ONLY_BEARER"). Because shell variables are expanded into the LLM's context and output, this pattern risks secret exfiltration if the environment variable value appears in logs or command outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The agent reads email drafts containing outsider-authored change requests and HTML body text retrieved from a notification service API endpoint.