react

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Google Drive direct-download links (drive.google.com/uc?export=download&id=...) are personal file-hosting endpoints that can deliver arbitrary file types (including executables) and are commonly abused to distribute malware, so using them as download sources is suspicious unless the file and publisher are verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source outsider-authored text is ingested from externally provided video URLs (captions/transcripts/page text are implied by scraped-content handling) during the “Per URL” workflow steps that download and “watch” the clip to derive the Topic line; the skill explicitly warns to treat that text as untrusted data.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill for high-entropy, literal values that look like real credentials and ignored obvious documentation placeholders (e.g., YOUR_AIRTABLE_BASE_ID, YOUR_TABLE_ID, YOUR_FIELD_ID, YOUR_DRIVE_FOLDER_ID) which are clearly placeholders.

I flagged the token-like string "shu8hvrXbJbY3Eb9W" on line 43 because:

• It is a short, random-looking alphanumeric string (high entropy).
• It is presented inline with a third-party tool reference ("Apify shu8hvrXbJbY3Eb9W") and not marked as a placeholder, example, or redaction.
• Such a string could plausibly be an actor/run ID or an access token that provides access to an external service, so it should be treated as a potential secret.

No other high-entropy credentials or private key blocks are present; other values are clearly placeholders or innocuous templates.