rabbit-hole

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The investigator templates explicitly require reading file contents and returning "key quote or data point" evidence and exact source lines (verbatim), which can force the LLM to include secrets (API keys, passwords, tokens) found in files or configs in its output—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the SCOUT agent to "Check: ... Web sources" and the INVESTIGATOR agent to "Read/fetch the full content" of leads (URLs), and the included scripts/validate_sources.py performs HTTP requests to validate URLs, so the skill ingests untrusted public web/community content which is then used to form findings and drive subsequent agent actions.