linkfox-echotik-list-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). EchoTik TikTok video listing ingests outsider-authored free text only as part of first-party-queried videoDesc values returned by the /echotik/listVideo API for user-supplied filters; the skill does not ingest arbitrary outsider post/comment text submitted by the attacker into a queue/feed it monitors without selecting query parameters.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected all files for literal high-entropy credentials. The only candidate that looks like a real, non-placeholder secret is the base64/URL-encoded string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py (used as a fixed uid header when no user_id is available). It is a concrete, random-looking value (not "REDACTED"/placeholder or a simple setup password) and is used in an authentication/login header, so it meets the definition of a secret.

No other high-entropy API keys, private keys, or similar literal credentials are present. Environment variable names, placeholders like "", simple example values, and documentation strings were ignored per the rules.