llmwhisperer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes curl examples and client code that embed the API key header (e.g., 'unstract-key: ' and api_key="YOUR_KEY"), which encourages inserting secret values verbatim into commands or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly supports processing documents from arbitrary public URLs (see references/api_reference.md "Process from URL" curl example and references/clients.md where whisper(...) accepts url="https://..."), so it fetches untrusted third‑party content, extracts text that the agent will consume, and that extracted content can materially influence subsequent LLM/tool behavior.