fdcnal-usda-fooddata-central-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow calls the USDA FoodData Central REST endpoints (e.g., https://api.nal.usda.gov/fdc/v1/food/{fdcId} / /foods/search) via scripts/run_api.js and then prints the response body, which can be ingested as free-form text into the agent’s LLM context; this is outsider-authored content from a third-party API.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I searched the skill contents for literal, high-entropy credentials. I found multiple random-looking strings that meet the "secret" definition (high entropy, appear usable as API keys) embedded in JSON auth fields.

Locations and values:

• reference/api_list.json (auth.value_encode for get_foods_multiple): Nrc9beuTOg2fU8wX10VF8pDCsiYL5JdODn9r/y6vdBrubsFb4q4bU2qGKN1mOv7qju7hfSwELlRHFs0rEDiimnwuvPY=
• reference/api_list.json (auth.value_encode for get_food_by_id): uldi1u60/qLyY5IxiFHhhIJPnutIdiogOusvM936LkqDM+wweer2h+nWzYDNBs0zSCkP+pMor+EvrHZMGejro1K8/Ds=
• reference/api_list.json (auth.value_encode for list_foods): ySDhZe/M7ZAaGuVXPFs0Vhc/0QPxALStuukDzy9gEsn9/44uy7v2u3jObzEbz6apg9T1VIL+U4cQk85nE/JH2GxMVsc=
• reference/api_list.json (auth.value_encode for search_foods): yg++JRa/DykHm2NW4rGmqz8oEnT+muHGnRc+zvvyY9xTC+6ZC/O7EIlWqDTodEjAVbXxLL4ZmAuAL7YDE1nzcH4M878=

These same values are duplicated in reference/marketplace_item.json.

Why these are flagged:

• They are long, random-looking strings (high entropy) and are stored as auth values, which strongly indicates they are API keys or encoded credentials that could be used to access the USDA FDC endpoints.

What I ignored:

• The export example DEEPNLP_ONEKEY_ROUTER_ACCESS=YOUR_REGISTRY_KEY is a documentation placeholder and not a real secret.
• There are no PEM blocks or other private keys in the content.

Recommendation: Treat the above value_encode strings as exposed secrets and rotate/revoke them if they are real keys, and remove them from the repository or move them to secure environment variables/secret store.