product-update-logger

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). This skill expands and prints/passes GITHUB_TOKEN (echo "GITHUB_TOKEN: ${GITHUB_TOKEN...}" and GITHUB_TOKEN="${GITHUB_TOKEN:-}" python3 ...) so secrets would be exposed in command output or embedded verbatim in commands, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's gather.py explicitly fetches GitHub PR data via gh_get/get_github_prs (calling the GitHub API for repos specified by the user) and SKILL.md/README show that PR titles and bodies are read and fed into the AI transformation step to generate changelog entries and content, so untrusted, user-generated third-party content can directly influence the agent's outputs and subsequent file writes.