daily-ai-agent-aigc-top-news

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires embedding Feishu/Bitable folder/base tokens and table IDs directly into CLI commands, URLs, and script args (e.g., --folder-token '<FEISHU_FOLDER_TOKEN>', --base-token '<FEISHU_BITABLE_BASE_TOKEN>' and URLs with <FEISHU_BITABLE_BASE_TOKEN>), which forces the agent to include secret/token values verbatim in generated commands/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Phase 2 "Source Collection" and example commands explicitly fetch and scrape public sites (Hacker News, GitHub, Hugging Face and other web/official pages via web search/extract) and requires the agent to read and use those results to select and publish briefing items, so untrusted/user-generated third‑party content can materially influence decisions.