azure-eventgrid-java

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This skill includes code examples that embed access keys directly (e.g., AzureKeyCredential("") and ENV var placeholders like EVENT_GRID_ACCESS_KEY=), which would lead an LLM to handle or insert secret values verbatim if a user supplies them.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow for “Receiving Events” uses Azure Event Grid receiver client code that ingests event payloads delivered by Event Grid, which are outsider-authored free text when an external publisher sends event data.