01-intake

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill explicitly claims a "cold audit" of only public-site data but then instructs using a LinkedIn session cookie/actor (userConfig.linkedin_li_at) and Sales-Navigator–aware actors to pull full rosters and member-only signals, which is an instruction to use privileged credentials and exceeds the stated public-only scope.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires using a LinkedIn session cookie stored as userConfig.linkedin_li_at (a secret session token) to call an actor, which implies the LLM/agent must read and embed that sensitive value into requests — a high-risk secret-handling pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Yes—SKILL.md:3-5 and :6-16 describes fetching a public agency website by runtime URL (via website-scraper/WebFetch/browser + SPA fallback), and the skill then ingests verbatim text from those outsider-authored pages into the agent’s LLM context (e.g., “verbatim” positioning/proof/5–15 phrases).