biomarker-investigation-zhcn

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill shows and instructs use of an API key embedded directly in a CLI/URL (e.g., "apiKey=sk-xxxx" / "你的API_KEY"), which encourages including secrets verbatim in commands and could cause the LLM to handle or reproduce actual secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在运行时会把用户的原始问题/多轮对话上下文直接用作网络搜索查询，并在需要时调用网络搜索工具把外部页面的自由文本整合进报告，因此存在第三方作者文本的间接提示注入风险。