query

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Because the prompt requires the agent to read workspace documents and include EXACT verbatim quotes when calling propose_workspace_suggestion, the model could be forced to output any credentials or secrets contained in those documents.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow includes “URL Ingestion” where it fetches arbitrary user-shared URLs via fetch_url, then extracts and saves/reads the fetched page text into the agent context—this is outsider-authored free text from public web content.