anysearch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The required runtime workflow invokes AnySearch CLI commands (e.g., search/extract) that call the public AnySearch endpoint https://api.anysearch.com/mcp, then place the returned result.content[...].text (outsider-authored web-extracted free text) directly into stdout, which the agent can ingest into LLM context.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal API key found in the .env file because it is a high-entropy, non-placeholder credential that would grant access if used (ANYSEARCH_API_KEY=as_sk_16c4f23c66e3a3b9c9683f79090fa912). Other values in the repository are placeholders (e.g., <your_api_key_here>), documentation examples, or configuration names and were ignored per the rules.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly instructs invoking PowerShell with "-ExecutionPolicy Bypass" (bypassing a system security mechanism) and also directs persisting API keys to a local .env file, so while it doesn't request sudo or system config/user creation, it does push the agent to bypass security controls and modify local disk state.