baoyu-danger-x-to-markdown

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill downloads and converts tweets/articles from X (Twitter) URLs provided by the user, representing external content fetched dynamically via targeted search/URL fetch without an unmonitored broadcast queue.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The files contain a hardcoded Bearer token (DEFAULT_BEARER_TOKEN) in scripts/constants.ts (line 4). This token is a valid, literal Twitter/X API bearer token (Bearer AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA), which is a hardcoded credential providing access to a service.