karpathy-llm-wiki

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md’s Ingest → Fetch (raw/) step instructs the runtime to “Get the source content using whatever web or file tools your environment provides” (including user-supplied URLs/files/pasted text), which means attacker-controlled outsider-authored free text can be ingested, read as prose, and then fed into the LLM for compilation.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned all files for high-entropy, literal values that look like real credentials. The only candidate is in examples/log-sample.md line [17]: "DiYndHeofovBUoxebYNcyd62nRf" — a random-looking alphanumeric string appearing next to "Lark", which plausibly represents a chat ID, webhook token, or other access token. This meets the "high-entropy literal value" criterion and is not a documentation placeholder or simple setup password, so I flagged it.

No other high-entropy API keys, private keys (PEM blocks), or obviously usable credentials were found. Many other values are filenames, dates, example placeholders, or simple words which I ignored per the rules.