earnings-calendar

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks users to paste their FMP API key into the session and shows examples that pass the key directly into commands/arguments (e.g., "${API_KEY}" on the command line and storing API_KEY in-session), which requires the LLM to accept and potentially emit secret values verbatim—an insecure exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's core workflow (Step 4 and scripts/fetch_earnings_fmp.py, plus references/fmp_api_guide.md) programmatically fetches and ingests earnings and profile data from the public Financial Modeling Prep API (and lists other public sites for manual fallback), and that untrusted third‑party JSON/website content is parsed and used to drive filtering, sorting, report generation, and follow-up actions—so external content can materially influence agent behavior.