algolia-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains explicit examples and workflows that pass API keys and other secrets as command-line arguments (e.g., --api-key "", algolia profile add), which would require the LLM to include secret values verbatim in generated commands and risk exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill includes explicit crawler commands that fetch and process arbitrary public URLs (see the "Crawler" section in SKILL.md and the crawler commands in references/commands.md such as "algolia crawler crawl" and "algolia crawler test"), so it ingests untrusted third‑party web content that the agent is expected to read and that can influence subsequent actions.