testing-api-for-broken-object-level-authorization

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt explicitly shows and requires embedding authentication tokens/cookies (e.g., Bearer JWTs) into request headers and asks the tester to paste real auth tokens into tools like Autorize, which forces handling/output of secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and parses arbitrary API/web content — for example SKILL.md's curl of https://target-api.example.com/api/docs/swagger.json and scripts/agent.py making requests to the provided base_url and interpreting JSON responses — and those untrusted third-party responses are used to drive vulnerability detection and subsequent actions.