upload-post

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes example curl commands and headers that embed the API key directly (e.g., -H "Authorization: Apikey YOUR_KEY") which encourages the agent to include secret values verbatim in generated commands/outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md explicitly documents endpoints that fetch public, user-generated content—most notably GET /uploadposts/reddit/detailed-posts (returns Reddit posts/media) and upload_videos which accepts video URLs (and FFmpeg endpoints that pull arbitrary inputs)—so the agent could fetch and interpret untrusted third‑party content that might influence subsequent actions.