substore-openclash

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the operator to read secret tokens (SubStore/AIO token, OpenClash secret, device MIIO token) and to embed them verbatim into curl/node commands (e.g., Authorization header and TOKEN variable), which requires the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). OpenClash on the gateway fetches SubStore’s generated AIO Clash YAML from http://<nas-ip>:3001/sub-api/api/file/AIO (pipeline output), so any outsider-authored text contained in upstream SubStore subscriptions/collections can flow into runtime YAML consumed by the gateway/Clash without selecting a specific item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The SubStore pipeline's first process operator is a linked remote JavaScript executed at generation time from https://cdn.jsdelivr.net/gh/powerfullz/override-rules/convert.min.js, so this URL is fetched and its code runs at skill runtime as a required dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a high-entropy, literal device token present in the documentation. The 32-hex string (000662ac87cd9dc57bc36b5a9816f917) is used as the MiIO device token in the local-miio verification and is a real secret (grants local device access). I ignored documentation placeholders like <SUBSTORE_AIO_TOKEN> and other non-secret examples.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit, repeatable instructions to SSH into hosts and modify persistent system and container files (editing sub-store.json, patching/homebridge node_modules, copying files into containers and restarting services), which changes the machine state and requires privileged access.