SG-062: Markdown Image Credential Exfil

Severity: HIGH

Markdown image URL templating a credential-named variable (EchoLeak / CamoLeak)

Fires when

• A markdown image URL (``) templates a credential-named variable such as `{API_KEY}`, `${TOKEN}`, or `%SECRET%` into its query string.
• Skill content directs the model to emit one markdown image per character of a secret (CamoLeak per-character exfiltration).

Related CVEs

• CVE-2025-32711
• CVE-2025-59145

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://nvd.nist.gov/vuln/detail/cve-2025-32711
• https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code