github-project-replication

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). 技能在多处要求列出/提示用户提供 API 密钥/Token、配置环境变量并生成 .env/配置文件，这会导致 LLM 需要接收并将密钥明文写入生成的配置或输出，从而构成高风险的凭据外泄。

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 该技能在阶段二/三要求“阅读 README.md（或类似项目文档）”并“获取目标仓库代码”，这些 README/文档属于运行时从用户指定的外部 GitHub 仓库拉取的内容，属于OUTSIDER-AUTHORED free text 会被读入并进入LLM上下文。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly parses and fetches target GitHub repositories at runtime and then runs/builds them (e.g., https://github.com/vercel/next.js/tree/canary/examples/with-docker and the placeholder https://github.com/user/repo), meaning remote code would be retrieved and executed as part of the skill.