Make Podcast

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's fallback REST examples explicitly show an Authorization: Bearer $AGENT_MEDIA_API_KEY header and cite the user's bearer token, which encourages including API tokens verbatim in requests/outputs rather than keeping them in the runtime/tooling — a high-risk secret-exposure pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill runtime ingests the user-supplied script free text in the POST https://api.agent-media.ai/v1/skills/make_podcast/run request body (via the mcp__agent-media__make_podcast tool/REST fallback), so outsiders can submit arbitrary lines directly into the generation workflow without selecting a specific trusted item first.