linkfox-kalodata-tiktok-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In this skill, the only runtime ingestion path is first-party parameter JSON supplied by the user into a Kalodata API call, and the workflow then reads only the vendor-returned structured response (e.g., scripts/kalodata_video_search.py calling /kalodata/video/rank and scripts/kalodata_video_detail.py calling /kalodata/video/detail), not outsider-authored free-text items from a queue/feed or arbitrary third-party submission.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill repo for hardcoded, high-entropy literal values that could grant access. The only candidate is a base64url-looking string hardcoded as a fallback UID header in scripts/onboarding.py. This is not a placeholder (it's a concrete encoded value, not "YOUR_API_KEY" or similar) and is used in authentication-related headers, so it qualifies as a potentially sensitive, usable token and is flagged.

No other high-entropy API keys, private keys, JWTs, or secrets were found. Other values are URLs, environment-variable names, example IDs, or simple config strings (placeholders or non-sensitive defaults), which I ignored per the rules.