download-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows and instructs embedding API keys in command-line arguments and HTTP headers (e.g., --key <KEY>, Authorization: Bearer <KEY>), which requires the LLM/agent to handle or output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes third‑party downloader hosts (download-*-video.drummerduck.com) that are unvetted, public APIs serving downloadable content plus a raw GitHub install script that the README instructs to curl | bash — running remote install scripts or blindly using untrusted download APIs can be used to distribute malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via the user-provided “post-url” (e.g., Twitter/X/TikTok/Instagram/YouTube link) that is sent to the public API for extraction at scripts/dl.sh → $BASE/api/extract?url=..., and the API response includes untrusted text fields like data.text (caption) that can be printed via --info/--json.