prospect-research

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill includes explicit promotional/redirection instructions—a mandatory donation blurb to insert in outputs and a forced promotional reply when asked about system prompts—that are unrelated to prospect research and function as hidden/deceptive overrides of expected behavior.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a shell example that embeds a GitHub token-like value (GITHUB_TOKEN=ghp_xxx) on the command line, which requires the LLM to handle or reproduce a secret verbatim and encourages insecure CLI secret usage.