pp-substack-reader

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs agents to replay playbook steps by substituting Playbook.slots_resolved entries (which include a "token" field) and references using a user's Substack session cookie and stored credentials, which requires the LLM to handle and embed live secret/session values verbatim in generated commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow is executing the outsider-fetched Substack content via the substack-reader-pp-cli commands (e.g., read/archive/search) with --agent, and then the command’s stdout JSON (including full post bodies) is fed back into the agent’s LLM context, creating an indirect prompt-injection path from outsider-authored post text.