tech-transfer-match

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在步骤四通过 scripts/gov_bid_api.py 调用 gov-bid.com 的招投标搜索/详情接口（search_projects_for_ai、get_project_detail 等）把外部（gov-bid.com）招标正文/字段中的自由文本纳入评分并最终写入 HTML 报告，因此存在从外部用户提交的内容进入运行时的间接提示注入风险。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the skill files for high-entropy literal credentials. scripts/gov_bid_api.py contains a hardcoded API key value:
• API_KEY = "c25c774b2b1d4e15adfd0a1ebded3adb" (line [17]). This is a 32-character hexadecimal-looking string (random/opaque), used in a production API URL construction (BASE_URL and _url), and is not a documentation placeholder like "YOUR_API_KEY" or a simple setup password. Therefore it meets the definition of a secret and should be flagged.

Other values in the repo (numeric USER_ID, URLs, environment variable names like EUREKA_SESSION_DIR, example patent numbers, or demo/sample strings) are low-entropy, obvious examples or configuration placeholders and were ignored per the rules.