split-stack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The subagent prompt requires returning verbatim file snippets in JSON (exact_text copied character-for-character from the head files), which forces the model to reproduce any secrets that happen to be in those files into its output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Step 1 reads PR metadata (number/title/body/url) via gh pr view and uses the PR body content for classification/possibly questions, so outsider-authored PR body text is ingested at runtime.