syncfusion-maui-ui-builder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly prompts for a Syncfusion license key and instructs the agent to inject RegisterLicense(licenseKey) into MauiProgram.cs, which requires the LLM to accept and output the secret value verbatim into generated code (secret exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text (the user’s natural-language request) is ingested at runtime by Stage 1 “Intent Analysis” (reads the user query) and then feeds downstream stages like Stage 3 layout analysis and Stage 4 control mapping via the controls_search.cjs BM25 mapper.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy credentials. I found a literal API-style key in the MAUI standards reference that appears to be an actual key string (sk_live_12345abcde) rather than an obvious placeholder token.

Why I flagged it:

• The value "sk_live_12345abcde" is a literal API-key-style string present in code comments/examples and matches common API key formats (prefix + random-looking characters). Per the secret definition, literal API keys should be flagged.

Why I ignored other examples near it:

• The DB connection string uses Password=secret123 which is a low-entropy, clear example/test password — treated as a documentation/example value (ignore per rules).
• LICENSE_KEY = "XXXX-XXXX-XXXX-XXXX" and occurrences of "YOUR_LICENSE_KEY" are obvious placeholders and documentation markers, so they are ignored.