nexusphpweb-site-config

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly asks the agent to collect and use the user's cookie to access pages and extract HTML, which requires the LLM to handle and likely embed the secret cookie value in requests or generated code/commands (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime workflow step 6/7 “抓取页面” uses the user-provided cookie to fetch arbitrary NexusPHPWeb HTML from the site root/paths and then parses the returned page content into infoFinder, which is outsider-authored free text (web page body) ingested into the agent context.