cli-commands

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill doc exposes many CLI flags that accept API tokens, bot tokens, passwords, and "plain secrets" (e.g., --token, --bot-token, --password, --plain-secrets, --include-key, --show-secrets), which would require an LLM to include secret values verbatim in generated commands or outputs if used—creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Windmill CLI skill exposes outsider-authored free text via runtime paths that can read arbitrary queue/job log content from the Windmill backend (e.g., job logs <id:string> / job result <id:string> and jobs pull fetching queued/completed job outputs), which an outsider can influence by submitting poisoned job inputs/logs into those queues.