finish-applications

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to retrieve email or SMS verification codes/magic links (and use private local credentials/iMessage 2FA) and then continue the application flow, which requires reading secrets (OTPs/magic links) and inserting them verbatim into web forms—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime LLM context is populated from the job/application web pages and form text it loads in the single-agent Chrome flow (e.g., job descriptions, ATS pages, and any pasted prompt-injection text on those pages), which are outsider-authored free text not chosen by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's start command runs "git pull --ff-only origin main", which fetches and can update executable repository code from the remote git "origin" during runtime (i.e., a runtime git remote fetch that can change scripts the agent will run), so this is a runtime external dependency that could control prompts or execute code.