geo-optimizer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly asks users to provide a Perplexity API key and shows an example passing it as a command-line argument (--api-key "pplx-xxx"), which requires including the secret verbatim in commands and outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 模块 E（/geo-content-optimizer <url>）在运行时会抓取用户提供的 URL 并获取“AI Overview 获取/对比分析”所需的网页文本，属于“公共 web 内容/任意 URL 抓取”这一类外部来源进入 LLM 上下文的间接提示注入风险。