dynamic-application-security-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows and instructs embedding plaintext credentials (username/password and token values) directly into scanner commands and configuration, which requires the LLM to handle and potentially output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill instructs the agent to spider and actively probe a provided target URL and ingest HTTP responses from that arbitrary public web application (see "Execute the DAST Scan" in Workflow step 3 and the Usage/Prompt example), so untrusted third‑party content is fetched and interpreted to drive scanning decisions and remediation actions.