wildix-get-conference

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires obtaining an IdToken and passing it explicitly as a command-line argument (bash ... "$ID_TOKEN" <conferenceId>), which forces the agent to handle and potentially emit the secret verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's runtime script (scripts/get-conference.sh) fetches conference data and "insights" from the external API https://wda.wildix.com/v2/... and SKILL.md explicitly uses those untrusted, third‑party insights (shortSummary, title, topics, decisions, etc.) to display, populate Obsidian notes, extract tags and ticket links, and drive downstream behavior — meaning external content is read and can materially change agent actions.