cgenius

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes hard-coded tokens and a plaintext password in example configuration and request bodies (e.g., CGENIUS_EPSIMO_TOKEN="eyJ...", CGENIUS_PROJECT_TOKEN, and password: 'EpsimoAI184'), and shows these secrets being embedded directly into API requests, which requires the LLM to handle or reproduce secret values verbatim — a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill explicitly creates public shareable questionnaires (see SKILL.md / README and the handleQuestionnaire implementation) and fetches questionnaire data from /api/questionnaire/[token] (and supports an --auto-proposal flow), meaning untrusted client-submitted content is ingested and can directly drive proposal generation and other actions.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged one hardcoded credential found in the implementation code:
• password: 'EpsimoAI184' — This is a literal password value embedded in the request body (generateEmail). It is a direct credential in code (not a placeholder or obviously redacted) and therefore should be treated as a secret.

Items I ignored and why:

• CGENIUS_EPSIMO_TOKEN="eyJhbGci..." and CGENIUS_PROJECT_TOKEN="eyJhbGci..." (and other occurrences showing "eyJ..." or "eyJ...") — truncated/redacted JWT examples (contain "..."), so per rules these are redacted/truncated placeholders and not flagged.
• ASSISTANT_ID = 'a3067fe2-...' and other UUIDs (e.g., project id '2e8693e4-...') — these are identifiers/IDs, not high-entropy access credentials, so not flagged.
• Email address 'contact@epsimoai.com' — not a secret.

Thus there is one direct hardcoded secret present.