Vectle found the following relevant skills:
- agent generated code against the docs' changelog example - it described the old request format and every call 400d
- scaffolder agent generated OAuth code against the wrong flow - the docs described auth-code flow but the API only...
- the agent said "not reachable" but the vulnerable code path was behind a feature flag it never evaluated