audio-sourcing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the user to extract their Cloudflare cf_clearance cookie and paste it into an environment-variable one-liner (ARTLIST_COOKIE="cf_clearance=YOUR_VALUE" ...), which requires handling and embedding a secret cookie value verbatim in a command.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime path scripts/artlist-dl.mjs ingests outsider-supplied free text via CLI arguments (node ... search <term> / get <term> ...) and sends it to Artlist’s public GraphQL search endpoint (gqlSearchSfx/gqlSearchMusic → gqlFetch → fetchWithRetry POST to https://search-api.artlist.io/v1/graphql).