geo-optimizer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt instructs the agent to ask the user for an API key and pass it as a direct command-line argument (--api-key "pplx-xxx"), which leads to insecure credential handling as the secret is exposed in the command output and LLM context.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The visibility tester script queries search APIs (Perplexity and Kimi) which retrieve and process external search results and web content containing untrusted third-party text.