external-system-debugging

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.85). Insecure: the skill instructs collecting and pasting raw request/response data and preserving original formats (e.g., curl -v output, headers, clipboard contents), which can include Authorization headers, cookies, API keys or other secrets that the LLM would then see verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 强调在运行时“抓真实数据”以分析第三方黑盒行为（如浏览器剪贴板 HTML/outerHTML、第三方编辑器渲染结果、以及 HTTP response body），因此用户可通过这些可提交渠道提供的外部文本会被 LLM 读取与处理。