linkfox-kalodata-tiktok-product

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md/scripts kalodata_product_search.py 與 kalodata_product_detail.py 在運行時會直接 POST 讀取 Kalodata 產品榜單/詳情 API 回傳的自由文本欄位（如 product_name）並將完整回應落盤/摘要輸出，且 productId 來源於前一步的 API 回傳而非先行固定某個可信項目。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I looked for literal, high-entropy values that could be usable credentials. Most values in the repo are examples (product IDs, URLs, environment variable names like LINKFOX_AGENT_API_KEY) or short/simple strings used for examples — those are documentation placeholders or non-secrets per the rules.

However, scripts/onboarding.py contains a hardcoded base64url-like token assigned to _LOGIN_FIXED_UID: "eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9" This is a non-placeholder, high-entropy literal used as a fixed uid header for the login chain (comment: "登录链路固定 uid header（实测可用）"). Because it is a literal token-like value (not an obvious placeholder) and is used in an authorization-related header, it meets the definition of a secret and should be flagged.

I did not flag product IDs, example API usage, environment variable names, or other human-readable strings because they are either low-entropy examples or placeholders per the "WHAT TO IGNORE" rules.