playbook-execute

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The playbook requires collecting developer-supplied variables (when defaults are empty) and substituting them verbatim into task prompts/inputs and included files, then delegating or printing those prompts—which forces the agent to handle and potentially emit secrets (API keys/passwords) directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow ingests outsider-authored free text via !include resolution: Step 1.5 reads arbitrary referenced files from paths in the playbook’s prompt fields and replaces !include <path> with that file contents, which then becomes the agent instruction in Step 4d.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill executes arbitrary terminal commands and reads filesystem paths from playbooks (including running checks that invoke arbitrary "run" commands and success heuristics that may execute commands), which enables modification of the host (including privileged actions if the playbook supplies them), so it can be used to compromise the machine state.