target-intelligence-zhcn

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes example/installation commands that embed an API key directly in a URL/command-line and instruct the user to insert their API_KEY, which requires handling or echoing secrets verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow takes user free-text, extracts entities/filters, and then uses those to call Patsnap MCP search/fetch tools (e.g., ls_target_fetch and downstream ls_search/ls_fetch), meaning outsider-authored input can influence what Patsnap returns and is ingested at runtime.