add-provider

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires "concrete smoke test commands using real values (not placeholders)" and instructs testing APIs with real calls, which forces embedding actual tokens/credentials verbatim into commands or outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly requires Stage 1 "Research" and the Decision Tree to fetch and inspect third-party API docs/OpenAPI specs and to perform real API calls (e.g., the curl examples against $GRAFANA_URL/apis and plugin API endpoints), which the agent must read and use to drive design and implementation decisions.