github-issue-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required runtime workflow for github-issue-agent ingests outsider-authored free text only from caller-supplied issue fields (e.g., title/body/comment_body) that must be explicitly provided to the skill, and it does not read arbitrary GitHub issues or external content as a prerequisite—searching dedup relies on the provided query inputs rather than consuming unsolicited outsider text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged literal, high-entropy tokens that appear in the repository as they match live credential patterns (GitHub PATs "ghp_" / "github_pat_" and OpenAI-style "sk-*") and are not placeholders or trivial setup passwords. Although these values appear in unit tests for the redaction scanner (i.e., test fixtures), they are still high-entropy literals that would be treated as secrets if real, so per the scanning rules they should be considered sensitive.

I did NOT flag the RSA private-key block in tests/test_secret_redaction.py because it is truncated with "..." (a redacted/truncated example) and the rules say to ignore truncated/redacted values.