quick-fix-suggestion

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly reads repository files and includes "Current" code snippets verbatim in its suggested code drafts (and does not require redaction), so any secrets present in those files would have to be output by the LLM.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and analyzes Gitee issue details and comments using get_repo_issue_detail and list_issue_comments (SKILL.md Step 1 and the Tool Reference), ingesting untrusted user-generated issue/comment content that the agent interprets and uses to decide code changes and next actions.