monitoring-observability

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes a curl command that embeds basic auth credentials (http://admin:admin@localhost:3000/...), which requires the LLM to output secret/password values verbatim and is an insecure credential-handling pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime stack includes an OpenTelemetry Collector that ingests outsider-supplied log/free-text payloads from network receivers (OTLP/Jaeger/Zipkin) and exports/processes them (e.g., logs pipeline: receivers=[otlp], exporters=[loki, logging]).