baoyu-danger-x-to-markdown

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The runtime path scripts/graphql.ts → resolveTweetQueryInfo/resolveTweetDetailQueryInfo/resolveArticleQueryInfo fetches public JavaScript/HTML from https://x.com and https://abs.twimg.com/... and then parses that fetched text (e.g., chunk/html) into the agent’s LLM-visible context via the produced markdown/JSON output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found one hardcoded credential-like value: DEFAULT_BEARER_TOKEN in scripts/constants.ts. It is a literal, long bearer-token string (prefixed with "Bearer ") that looks like a high-entropy API authorization token and therefore qualifies as a secret.

I did NOT flag other values because:

• FALLBACK_* IDs and feature-switch strings are query IDs or feature keys (not authorization credentials).
• The DEFAULT_USER_AGENT is just a user-agent string (not a secret).
• Cookie name lists and environment variable names (e.g., X_AUTH_TOKEN, X_CT0) are just identifiers/placeholders for where secrets should come from, not secret values themselves.
• Short alphanumeric IDs (e.g., "id8pHQbQi7eZ6P9mA1th1Q") appear to be API/query identifiers or constants, not high-entropy credentials.

Therefore the only real secret present is the DEFAULT_BEARER_TOKEN literal.