legal-downloading

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes code that hardcodes API credentials (api_key/api_secret) and places them directly into HTTP headers and a usage example with literal credential strings, which encourages embedding secret values verbatim in generated code/requests.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime path includes scraping arbitrary third-party web pages for license text via LicenseChecker.check_url() which fetches response.text from a user-supplied URL (requests.get(url)), so outsider-authored free text can be ingested at runtime without selecting a specific trusted item first.