kanban

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt requires the agent to write, stamp, and share the actual published board URL (which functions as an access token granting full read/write) into files and messages, forcing the LLM to output that sensitive URL verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The outsider-authored free text is board/task content provided by any user with write access to the Kanban board, which the connector reads at runtime via HTTP POSTs to the board API endpoints like /ajax/tasks/board/get, /ajax/tasks/list/get, and /ajax/tasks/task/get (used by kb_health, kb_list_tasks, and kb_summary).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). kanban.html loads and executes remote JavaScript from the unpkg CDN at runtime (https://unpkg.com/react@18/umd/react.production.min.js, https://unpkg.com/react-dom@18/umd/react-dom.production.min.js, https://unpkg.com/@babel/standalone/babel.min.js), and the UI depends on those scripts to run — i.e. remote code is fetched and executed during skill runtime.