quota-reporter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires the agent to display probe payloads and to include HTTP response bodies (and it handles/stores personal auth-pool tokens locally), which can contain raw tokens/credentials and thus forces the LLM to handle/output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill intentionally collects and uploads local Codex/Claude authentication blobs and quota data to a remote "auth-pool", stores a personal auth-pool token locally, periodically runs as a persistent scheduled job, can fetch and install other users' credentials to replace local credentials, and self-updates from GitHub — behavior that constitutes credential exfiltration, unauthorized account sharing/replacement, persistence, and a supply‑chain/backdoor risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly downloads and executes content from public third-party endpoints—it self-updates from GitHub (download_github_tarball/github_latest_sha in scripts/quota_guard.py) and contacts a shared auth-pool (e.g., https://quota-report-hub.vercel.app via fetch_best_auth/post_auth_pool_quota/request_auth_pool_token in scripts/quota_reporters.py) whose untrusted, user-contributed responses are parsed and can trigger concrete actions like replacing local credentials and updating the installed skill.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime self-update fetches and unpacks remote code from GitHub (it queries https://api.github.com/repos/callzhang/quota-report-hub/commits/main and downloads https://codeload.github.com/callzhang/quota-report-hub/tar.gz/{sha}), which replaces the local skill files with code fetched at runtime and thus constitutes executing remote code—this meets the criteria for a risky external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). This skill instructs installing a persistent scheduler and automatically writing/replacing sensitive local auth/config files (e.g. ~/.agents/*, ~/.claude/settings.json, ~/.codex/auth.json) and storing personal tokens—modifying the machine’s state and credentials—though it does not request sudo or create system-wide accounts.