scholar-agent

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes an explicit CLI option to paste a session cookie value (scholar-inbox login --cookie VAL) and describes copying cookies from DevTools/session.json, which instructs embedding secret credentials verbatim into commands or outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill programmatically fetches paper digests from the public Scholar Inbox REST API (https://api.scholar-inbox.com) and batch-adds public arXiv URLs (https://arxiv.org/abs/...) into NotebookLM, then reads NotebookLM's source-grounded answers as part of its workflow (SKILL.md/README), so untrusted third‑party document content directly influences classification, ingestion, follow-up queries, and downstream actions.