security-headers

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly prints collected HTTP response headers and echoes header values (e.g., via cat /tmp/headers_raw.txt and check_header), which can include sensitive Set-Cookie, Authorization, or other tokens, so it requires outputting secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). This skill's required workflow (Step 1: the curl command in SKILL.md that fetches TARGET_URL and writes response headers to /tmp/headers_raw.txt) clearly ingests response headers from arbitrary public URLs and then parses those untrusted, third‑party header values as part of its decision logic and remediation output.