byted-kickart-video-analyzer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to post their ACCESS_KEY_ID/SECRET_ACCESS_KEY in chat and shows commands that echo and export those values, requiring the LLM to handle and output secret values verbatim (high exfiltration risk).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High risk: the skill explicitly instructs soliciting users' ACCESS_KEY_ID/SECRET_ACCESS_KEY via chat (social‑engineering to obtain credentials) and the code transmits/logs data to external API endpoints, enabling credential theft and unauthorized data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 运行时会把用户提供的视频文件/网络URL转存后进行解析，解析结果中的字段（如口播/旁白/字幕等）会被写入输出JSON并用于消息模板渲染，因此存在“外部用户提交内容→经解析服务返回文本→Agent读取/回显”的间接提示注入暴露。