proposal-lit-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to create or update an api-keys.env file with entries like OPENALEX_API_KEY=..., which requires the agent to receive and embed secret API key values verbatim into workspace files (and thus into its outputs), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path scripts/search.py takes user-supplied query and passes it to federated source clients that fetch and ingest third-party text/metadata (e.g., arXiv Atom XML via scripts/arxiv.py and Crossref abstracts via scripts/crossref.py), so outsider-authored free text can enter the LLM at runtime through these responses.