autoglm-deepresearch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds a hard-coded secret (the string "38d2391985e2369a5fb8227d8e6cd5e5") and requires computing/including X-Auth-Sign and Authorization headers derived from it, which forces the agent to handle and potentially output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and scripts (web-search.py and open-link.py) explicitly perform web searches via the autoglm web-search API and then call the open-link endpoint (https://autoglm-api.zhipuai.cn/.../open-link) to fetch arbitrary page text (data.text) which the agent reads and integrates into its research/report, so untrusted public web content can directly influence its analysis and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill at runtime calls the external APIs https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/web-search and https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/open-link to fetch search snippets and full page text which are then injected into the agent’s context and directly drive its prompts/output, and those endpoints are required dependencies.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Flagged item:
• The literal string 38d2391985e2369a5fb8227d8e6cd5e5 appears in the X-Auth-Sign formula MD5(100003 + "&" + timestamp + "&" + 38d2391985e2369a5fb8227d8e6cd5e5). This is a 32-hex-character, high-entropy value used as a shared secret to compute request signatures — a usable credential. It is directly present in the doc and should be treated as a secret.

Ignored items (not flagged) and why:

• "Bearer xxx" returned from http://127.0.0.1:53699/get_token: placeholder/truncated example — ignored.
• X-Auth-Appid: 100003 and X-Auth-TimeStamp (timestamp): numeric identifier / timestamp, not secret.
• Endpoints and example scripts (URLs, python commands): configuration/instructions, not secrets.