omni-recall

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes insecure patterns: examples that pass secrets directly as CLI arguments (e.g., sync-vault "ZHIHU_COOKIE" "your_long_cookie_string") and instructs fetching/decrypting vault values, which would require the agent to handle and potentially output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can enter the agent’s LLM context via fetch-full-context → fetch_profile() / fetch_instruction() / fetch() which read content fields from Supabase tables (profiles, instructions, memories) that may have been populated from external sources (e.g., batch-sync-doc fetching arbitrary URLs at runtime) and then return that stored prose to the caller.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)