alterlab-labarchive

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains examples and CLI/config patterns that embed API keys and passwords verbatim (config.yaml placeholders, client initialization with access_key_id/access_password, and a backup-all command using --password), which would require the agent to handle and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's workflows and scripts explicitly fetch and parse user-generated content from third-party APIs (e.g., LabArchives API endpoints like notebooks/notebook_backup and entries in SKILL.md and scripts/notebook_operations.py / scripts/entry_operations.py, and external sources such as Protocols.io shown in references/integrations.md), so untrusted third‑party content is ingested and used in runtime operations (creating entries, backups, uploads) that could influence subsequent actions.