lobehub-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes an example that embeds a bot token as a command-line argument (--bot-token ), which encourages passing secrets verbatim in generated commands and therefore requires the LLM to handle/output secret values directly (high exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Direct ZIP download links for installing skills (https://example.com/my-skill.zip and https://example.com/skill.zip) are potentially dangerous because ZIP packages from untrusted domains can contain arbitrary executables/scripts and bypass package-manager protections.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Skill installation (lh skill install <source>) can pull a skill from an outsider-controlled source (GitHub/ZIP/marketplace) and that outsider-authored prompt/content is then used as the skill’s instruction, which the agent will feed into its LLM context at runtime—this is classic outsider-origin free-text prompt injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI documents a runtime "skill install" command that fetches and installs external skill packages (e.g., lobehub/pdf-skill, https://github.com/lobehub/pdf-skill, https://example.com/my-skill.zip), which will retrieve remote code/content at install time that can include prompts or executable logic controlling agent behavior.