load-context

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to fetch and present full context files (from local paths, URLs, or git via gh api) and to display their contents, which would force the LLM to output any embedded secrets verbatim if those context files contain API keys, tokens, or passwords.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests third‑party content via the "LOAD FROM URL" (uses WebFetch) and "LOAD FROM GIT REF" (uses gh api) workflows, and then reads/presents that content as the loaded context to prime subsequent agent actions, so untrusted web or repo content could inject instructions that influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches arbitrary http:// or https:// URLs via WebFetch and GitHub files at runtime using "gh api repos///contents/", and then presents that fetched markdown/HTML as the conversation context—allowing remote content to directly control agent prompts.