Shodan Reconnaissance and Pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly shows API keys placed inline (e.g., shodan init YOUR_API_KEY, curl URLs with ?key=YOUR_KEY, shodan.Shodan('YOUR_API_KEY'), API_KEY = 'YOUR_API_KEY'), which forces the agent to accept and emit secret values verbatim in commands/code—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). SKILL.md describes using Shodan CLI/REST API to search/download parse results, which at runtime ingests publicly sourced Shodan scan/search result text (outsider-authored data) into LLM context if the agent summarizes or parses the downloaded JSON/response.