watch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to AskUserQuestion for an API key and write it into ~/.config/watch/.env (and otherwise references handling API keys), which requires the LLM to receive and output secret values verbatim (e.g., to write or echo them), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow downloads a user-supplied URL’s native subtitles (VTT) via yt-dlp and parses their cue text (scripts/download.py → scripts/transcribe.py → scripts/watch.py), which is outsider-authored free text that is then printed into the report and becomes LLM context when the agent uses it to answer.