last30days

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask the user to paste an API key (e.g., "I have an xAI API key") and then write that value into .env, which requires the LLM to receive and handle the secret (and typically embed it verbatim in shell/file-writing commands) — a direct secret-exfiltration/exposure risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow runs scripts/last30days.py which fetches and ingests outsider-authored free text from public platforms (e.g., Reddit/X/YouTube/TikTok/Instagram/HN/Polymarket and post-engine WebSearch supplements) into the agent’s LLM context for synthesis.