uno-overlays-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires embedding the app token directly into API URLs and HTTP requests (e.g., PUT to /controlapps/{{token}}/api), which forces the agent to include secret tokens verbatim in generated commands or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and parse live API/docs and model data from third‑party app endpoints (e.g., GET https://app.overlays.uno/apiv2/controlapps/{{token}}/api/info, /api/json and /model or using GetCustomizationModel/GetOverlayModel) and to use that returned, potentially user-defined content to drive commands and UI, which exposes it to untrusted/third‑party user-generated data that can influence actions.