gzh-design

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md 的运行路径会读取用户提供的 Markdown/纯文本（含第 11 行提到的 .md/其他非 Markdown 需先转成 Markdown），并在后续第 3-4 步将这些内容作为 LLM 可读自由文本进行解析与装配，因此存在间接提示注入风险。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository content for high-entropy, literal secrets. I found a long, random-looking token passed as a URL query parameter named sealed_token in the Star History image src/srcset entries. This appears to be a signed access token (high entropy, not a placeholder) and therefore qualifies as a secret that should not be published.

Other strings in the docs (WeChat handles like "zuiyn_soul", image URLs, color hex codes, example names like "甲木", and template placeholders such as {...} or {{作者名}}) are low-entropy or clearly placeholders/documentation content and were ignored.