huawei-cloud-vod-collector

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to extract and display login artifacts (login_url, qr_code, session_id) and to run a command that embeds <session_id> on the command line, and it also documents that an access token is saved in plaintext to ~/.atomcode/auth.toml — all of which require handling secret-like values verbatim and thus risk exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains deliberate mechanisms that can read arbitrary local files into feedback records (via "@filepath"), automatically deliver those records to an external GitCode repository using a locally-read AtomGit token, and install/execute third‑party binaries—creating clear, high-risk data-exfiltration, credential exposure, and supply-chain vectors.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Phase 1 capture triggers on outsider-authored user/tool content (e.g., OpenClaw UserPromptSubmit / PostToolUse), which is then passed into Phase 2 “Enrich feedback with context using LLM” for extraction—so the LLM context can contain free text authored by others (not chosen by the operating user).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install and auto-login flow instructs cloning/building/running the AtomGit-GO project from https://gitcode.com/weixin_45218422/AtomGit-GO (appearing as https://gitcode.com/weixin_45218422/AtomGit-GO.git in install scripts), which fetches remote code and installs/executables that run at runtime for the QR login, so this is a runtime external dependency that executes code.