news-extractor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 该 skill 在运行时通过用户提供的 URL 进行 HTTP 抓取（如 scripts/crawlers/base.py 的 fetch_content() → fetcher.fetch()），将第三方新闻页面 HTML 解析为文本/标题等字段，并在 scripts/extract_news.py 里把这些文本写入 JSON/Markdown（可被上层 LLM 读取），属于“公共网页内容/第三方站点正文”进入上下文的间接提示注入风险。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy credentials that could grant access.

Flagged findings:

• scripts/crawlers/toutiao.py — FIXED_COOKIE is a long, literal cookie string (e.g. contains passport_auth_status_ss, ssid_ucp_sso_v1, ttwid, csrftoken, s_v_web_id, tt_scid, tt_webid, etc.). These are authentication/session cookie values and include high-entropy tokens that can be used in an HTTP Cookie header to access accounts/content — qualifies as secrets.
• scripts/crawlers/wechat.py — FIXED_COOKIE is a literal Cookie line (RK=KfsE+4gSss; ... ptcz=13cd54e3...; wxtokenkey=777). It contains token-like values (ptcz long hex-like value, RK token) that can be used for session/authentication.

Ignored (not flagged) items and why:

• FIXED_USER_AGENT values (user-agent strings) — not secrets.
• Empty FIXED_COOKIE definitions in netease/sohu/tencent (they are empty strings) — nothing to flag.
• uv.lock package hashes and filenames — these are package distribution hashes, not credentials.
• Any other plain/example strings (URLs, sample commands, README text) — documentation/examples, not credentials.

Because there are hardcoded cookie values that appear to be real session/authentication tokens (high-entropy, literal, and usable in HTTP headers), I treat this as containing active secrets.