openclaw-support

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests public, user-generated TikTok/Douyin content (see /search, /breakdown, /download, and /replicate_from_social endpoints in SKILL.md) and analyzes/uses that content to drive replication, generation, and task decisions, so third-party page/video content could indirectly inject instructions influencing agent behavior.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the full skill prompt for literal, high-entropy credentials. I flagged the signed S3 URLs because they contain full X-Amz-* signature parameters (including X-Amz-Signature and X-Amz-Credential) — long, random-looking values that grant access to the referenced objects while the signature is valid.

Matches considered and why:

• Flagged: The full signed URLs in the examples:
• Response Example 1 (type=project) -> data.videos[0].videoUrl contains X-Amz-Algorithm, X-Amz-Credential, X-Amz-Date, X-Amz-Expires, X-Amz-Signature, etc. The X-Amz-Signature value is a high-entropy hex string and the URL is a usable, signed access token to the storage object.
• Download response -> data.download contains the same style of signed URL with X-Amz-Signature and related parameters. This is likewise a high-entropy, literal signed access token. These signed URLs are time-limited credentials that directly provide access to stored video assets, so they meet the definition of a secret in this doc.
• Ignored items (not flagged) and why:
• Authorization: Bearer $CLIPCAT_API_KEY — environment variable placeholder, no literal secret present.
• "Get your API key at: https://clipcat.ai/…" — instructions/placeholder, not a secret.
• Truncated/example values like "https://v16m.tiktokcdn-us.com/..." — truncated/redacted, ignore.
• Simple/example passwords or tokens (none present besides placeholders) — per rules, low-entropy or sample values are ignored.
• UUIDs like creditId and taskId — not secrets by themselves.

Conclusion: the documentation includes explicit signed URLs with X-Amz-* signature parameters (high-entropy, literal values that grant access) and these should be treated as hardcoded secrets in the document.