keepflash

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In KeepFlash’s runtime, outsider-authored free text is ingested via the user-controlled retrieval commands context --query, search --query, and read --id which fetch untrusted note content and return contextText/notes snippets that the agent then uses to answer and/or write updates.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged literal KeepFlash-style bearer tokens that appear in the test fixtures because they match the token shape (kf_mcp_live_...) and are high-entropy, literal values that would grant access if valid. Even though they are used in tests, they are concrete token strings present in the repository and therefore treated as secrets by the scanning rules.

I am ignoring short, non-random values such as "private-device", "KF-ABCD-EFGH", "environment-token", "file-token", "new-token", and similar test/placeholders because they are low-entropy, clearly example values or ephemeral codes and do not meet the high-entropy secret definition. I also ignored regexes and code that merely describe token patterns (e.g., the sanitize regex) since they are not credentials themselves.