google-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill primarily expects FREVANA_TOKEN to be read from the environment (secure), but it explicitly allows an interactive prompt and a --token override (example shows passing "your bearer token"), which would require the agent to accept and potentially embed the secret verbatim in commands—creating a secret-exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill calls a runtime HTTP endpoint (curl POST to https://ai-factory.frevana.com/service/google-search) and then reads the returned response body as text and validates/parses it as JSON (python3 loads RESPONSE_FILE), so any free-form text contained in that outsider-authored response becomes LLM-visible via stdout (and is also saved to disk).