hinge-liker

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt explicitly instructs the user to "Hardcode GEMINI_API_KEY in the cron payload", which violates secure credential handling practices by putting secrets directly into configuration or scripts rather than relying on environment variables or secure secret stores.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow scrolls through dating profiles on Hinge and ingests user-authored profile text and images via Gemini vision AI screenshots without the agent first selecting a specific item.