linkfox-echotik-get-video-download-url

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In scripts/echotik_get_video_download_url.py, the runtime reads only user-provided url (as a single TikTok video URL) to call POST /echotik/getVideoDownloadUrl, and then ingests only the trusted API JSON response to extract/print download/playback fields.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal, high-entropy values that could be usable credentials. The only candidate is a base64url-like string hardcoded as the default LOGIN_FIXED_UID in scripts/onboarding.py. It is not a placeholder (not of the form YOUR*/), appears to be an encoded/opaque identifier used in request headers for login flows, and thus could be a usable/privileged value. No other files contain direct API keys, private keys, or other high-entropy secrets — environment variable names and example placeholders (e.g., "", $LINKFOXAGENT_API_KEY) are present but are intentionally configuration placeholders and were not flagged.