generate-eval

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt instructs the model to pull and quote raw trace content into few-shot examples (via get_observation_details_with_content) but only mandates scrubbing certain PII (emails, phones, SSNs, cards) and does not explicitly forbid or require redaction of API keys/tokens, so the LLM may be forced to output secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Workflow A/“from traces” reads prompt/completion text only from the Progress Observability Platform via read-only MCP tools (get_observation_details_with_content), where trace content is explicitly treated as untrusted data under evaluation rather than instructions, and there is no workflow path that ingests arbitrary outsider-authored free text without first selecting specific observation IDs (and often gated by an interactive approval).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill explicitly calls the Progress Observability MCP endpoint (https://mcp.observability.progress.com/mcp) at runtime to fetch observation content that is then quoted as few-shot examples into evaluator prompts, so the external URL is used during runtime and can directly influence the prompts.