azure-mgmt-apimanagement-py

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes code that embeds a literal secret value when creating a Named Value ("secret-key-value") and prints subscription.primary_key, which encourages handling and echoing secrets verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's SKILL.md explicitly instructs importing APIs from external URLs (see "Import API from URL" using ContentFormat.OPENAPI_LINK with value "https://petstore.swagger.io/v2/swagger.json"), which requires fetching and interpreting untrusted/public OpenAPI documents that can materially change API configuration and subsequent actions.