content-collector

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 运行时会把用户提供的链接/截图中提取的 URL 交给 Agent 调用外部抓取 skill（如 web-content-fetcher/defuddle/x-tweet-fetcher），这些 skill 会读取“网页正文/推文正文”等 OUTSIDER 文本并注入到 LLM 用于摘要与整理。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for literal, high-entropy credentials.

Findings:

• The string ND8ObCuSya5Dv3sREZYc03Ilngh appears in SKILL.md / README.md and as DEFAULT_APP_TOKEN in scripts/save_to_bitable.py. This is a high-entropy literal value that functions as a Feishu (Bitable) App Token and therefore qualifies as a secret/API key.
• The string tblaHDM5kjtikIl9 (Table ID) also appears in multiple places. A table ID is an identifier (less sensitive than an access token) but is a literal resource identifier; it is noted here for context but is not the primary secret.
• No other high-entropy API keys, private keys, or tokens are present. Environment variable names (FEISHU_USER_ACCESS_TOKEN) are only referenced without values and were ignored per the rules.
• No placeholders, simple example passwords, or truncated/redacted values were flagged.

Therefore I mark this as containing a real, high-entropy credential (the default App Token).