paragraph-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes explicit examples and directives to pass API keys/tokens directly in commands (e.g., --token, inline PARAGRAPH_API_KEY=, echo "" | paragraph login), which would require the LLM to accept and emit secret values verbatim, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs the agent to fetch user-generated content from paragraph.com (e.g., "paragraph post get --id --field markdown", "paragraph post feed", and export/paginate examples) so the agent will ingest and read public third-party posts whose contents could influence subsequent actions like updates, publishes, or emails.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill recommends running a local MCP server via a runtime npx command that fetches and executes remote code ("npx @paragraph-com/mcp"), which is a required local-deployment path and thus a high-confidence runtime external dependency that executes remote code.