scrapling

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs capturing, reusing, and saving cookies (including user-provided session tokens) into a cookie-vault and substituting them into generated scripts/templates, which requires the LLM to handle and potentially output secret cookie values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 该技能在运行时会对“目标网站 URL/页面内容”发起抓取（Fetcher/StealthyFetcher/DynamicFetcher），从而把**公网上的网页正文/HTML（外部作者内容）**经 page.text/page.css(...) 变成可读文本进入 LLM 上下文；属于“公共 web 内容在运行时获取并被解析”的间接提示注入风险。