skill-benchmark

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to "read the full file into context" and to "expand any dimension score with full evidence from the skill text" and to extract the full description, which requires ingesting and potentially outputting verbatim content from SKILL.md — meaning any embedded secrets would be handled and could be included in the agent's output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In skill-benchmark Step 0/Step 1 it reads a user-specified or searched local SKILL.md file into LLM context (“Read the full file into context before proceeding” and “Extract… full text” from that file), which is outsider-authored free text that the runtime directly ingests.