gh-issues

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill relies on a GH_TOKEN secret and, while it mostly uses the env var ($GH_TOKEN), it explicitly instructs exporting/printing the token and embedding it into git remote URLs (e.g., export GH_TOKEN "", echo "Token: ${GH_TOKEN:0:10}...", and https://x-access-token:$GH_TOKEN@...), which can cause secret values to be revealed or persisted in generated commands/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text from GitHub issues/PRs is fetched at runtime via the GitHub REST API (Phase 2: body field) and then injected into the sub-agent LLM prompt as {body} (Phase 5 “Sub-agent Task Prompt”).