debug-fetcher

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly solicits and stores human-provided credentials/headers in memory and exports learned strategies (including headers/human-provided info), which creates situations where the agent would receive and then output secret values verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches arbitrary public URLs provided in manifests or command arguments (e.g., fetch-batch reading a manifest of one URL per line and calling the external fetcher via FETCHER_SKILL_PATH in strategy_engine._run_fetcher, plus /ingest-youtube for YouTube transcripts), inspects and interprets returned page/transcript/extracted_text/content_verdict to choose strategies, learn/store behavior in /memory, and drive recovery actions—so untrusted third‑party content from the open web directly influences tool use and decisions (see SKILL.md, cli.fetch-learn-batch, and strategy_engine.py).