last30days

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to ask users to paste API keys/cookies and to write them into ~/.config/last30days/.env or similar files (and to surface one-shot codes), which requires handling and potentially emitting secret values verbatim in commands or file-writing instructions.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow for /last30days ingests outsider-authored free text by fetching and reading platform user-generated content (e.g., Reddit comments, X posts, YouTube/TikTok/Instagram captions/comments, Hacker News comments) in `Step 1
• RUN THE ENGINEand then surfaces it in the synthesis (including verbatim community comments via the## Top Community Comments` evidence).