x-ingest

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow fetches X (Twitter) posts via user-provided URLs and public syndication endpoints, ingesting outsider-authored social media content into the agent's environment.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The script fetches a model from Hugging Face (iic/SenseVoiceSmall) via ModelScope/FunASR during video transcription, which is an external operational dependency with common unofficial or third-party hub provenance.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The script contains a hardcoded Twitter/X anonymous bearer token (_GRAPHQL_BEARER) on lines 44-47 of scripts/fetch_tweet.py. While it is a publicly shared/anonymous client token used by Twitter's web front-end rather than a private user secret, it still qualifies as a credential/API token providing access to Twitter's internal GraphQL endpoints.