rpa

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes code that captures network requests and exports curl commands with full headers and post data (and also contains examples with hardcoded usernames/passwords), which would require the LLM to include secret values verbatim in its output.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most URLs are benign test sites and API endpoints, but the presence of a direct shell installer (https://astral.sh/uv/install.sh) — plus multiple webhook, vault and local/internal endpoints that could be abused to deliver or execute code — makes the set a potentially risky download/execution vector.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow can fetch and ingest arbitrary outsider-authored web page content via Playwright navigation/scraping (e.g., page.goto(url) then page.content() / text_content() / inner_html()), which becomes readable prose in the agent’s LLM context if that extracted text is passed along.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository includes Dockerfile/CI instructions that run a remote installer via "curl -LsSf https://astral.sh/uv/install.sh | sh", which fetches and executes remote code as part of setup/build (a required dependency for the documented workflow), so it clearly executes external code at runtime/build time.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, potentially active credentials (high-entropy secrets). I found a Base32 TOTP secret "JBSWY3DPEHPK3PXP" present in multiple example blocks (explicitly annotated as a "Base32 secret" in the MFA example and included in the .env template). A Base32 TOTP secret is high-entropy and can be used to generate valid TOTP codes (i.e., it is a usable credential), so it meets the definition of a secret.

I ignored many other strings that are clearly examples/placeholders or low-security demo passwords:

• "SuperSecretPassword!", "password123", "demo", "demo123", "pass", "secure_password", "api_key_123", "my_secure_master_password", etc. These are example/demo values or obvious placeholders and per the rules should not be flagged.
• Environment variable names (e.g., VAULT_TOKEN, RPA_PASSWORD) and CI/CD secret references (e.g., ${{ secrets.* }}) are just names/placeholders and were ignored.
• No private key blocks (PEM), full API keys (sk-...), or redaction markers like REDACTED_SECRET_ were present.

Occurrences of the flagged value:

• rpa-credentials example .env template: RPA_TOTP_SECRET=JBSWY3DPEHPK3PXP
• rpa-authentication examples: totp_secret="JBSWY3DPEHPK3PXP" (used in MFA/TOTP examples)

Therefore I mark that a real, high-entropy secret is present.