extract-annotation-source

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to evaluate and return the value of window.AXHUB_ANNOTATION_SOURCE verbatim, which could contain API keys or other secrets from the page and thus enables direct exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md:7-10 describes opening a requested prototype URL at runtime and evaluating window.__AXHUB_ANNOTATION_SOURCE__ from that page, which is outsider-authored free text coming from arbitrary web page content.