infographics

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes a --api-key CLI option and examples that show passing API keys on the command line (and a placeholder export), which encourages embedding secret values verbatim into commands or generated code and therefore creates an exfiltration risk despite also mentioning the safer env-var approach.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). When --research is enabled, the skill calls Perplexity Sonar Pro (research_topic() → requests.post(.../chat/completions)), and the returned research text (research_result['content']) is directly appended into the generation prompt (_enhance_prompt_with_research()), so outsider-authored web-derived free text can enter the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill makes runtime POST requests to the OpenRouter API at https://openrouter.ai/api/v1 to call Perplexity Sonar Pro (research) and Gemini models (generation/review), and those model responses are directly injected into generation prompts and review-based prompt improvements (via _enhance_prompt_with_research and improve_prompt), so external content can control the agent's prompts at runtime.