alibabacloud-media-diagnostics

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates echoing the exact user-provided file path or URL verbatim in final output (even for unreachable/degraded paths), which forces the LLM to reproduce any sensitive tokens or signed-query secrets contained in that input.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text can be injected into the HLS workflow because hls_check.py fetches and parses the user-provided m3u8 playlist URL/content (fetch_url(m3u8_url) then parse_m3u8(resp["body"], base_url)), and that playlist drives subsequent segment URL reachability/integrity reads.