deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to fetch and "present" and "share" the RHDH URL and credentials from the bot's PR comment (and to propagate secrets into configs or PRs/Vault), which requires reading and outputting secret values verbatim—an exfiltration risk despite some guidance to avoid printing secrets in-shell.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and parse plugin definitions and package metadata from the public "rhdh-plugin-export-overlays" GitHub raw URLs (see "Data Sources" and Steps 2–3 in Part 1 of SKILL.md) and then use that content to modify configuration and drive deployment decisions, so untrusted third‑party content can directly influence tool use and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly curls runtime URLs such as https://raw.githubusercontent.com/redhat-developer/rhdh-plugin-export-overlays/main/catalog-entities/extensions/plugins/.yaml (and related raw.githubusercontent.com metadata URLs) to fetch YAML that contains spec.dynamicArtifact OCI image references and appConfig snippets which are required by the skill and will cause remote artifacts/configuration to be pulled and executed/applied, so the fetched content can directly control what code/config is run.