competition-request-normalization-smuggling

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires preserving and outputting raw request pairs, hop-by-hop headers/logs and exact normalization deltas (e.g., Authorization headers, cookies, or other sensitive header/body data), which forces the LLM to handle and potentially emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). 该技能的运行流程要求“记录/捕获原始请求对、代理与后端解析日志、并复现最小差异请求路径”，这些“原始请求/日志/路由证据”通常包含由外部参与者（非操作用户）提交的基线与差异请求文本，因此会在运行时以可读文本形式进入LLM上下文；不属于排除项（如仅引用的URL或捆绑参考材料）。