overseas-trending-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks for an API key and shows examples that pass it as a command-line argument (--api-key ak_你的密钥) or echo it into a config file, which would require an agent/LLM to handle and potentially emit the secret value verbatim (insecure).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在运行时会对外部平台进行关键词搜索并把返回的标题/作者等自由文本（来自 X/TikTok/YouTube 的帖子内容）写入 HTML 模板的 {{INITIAL_DATA}}（scripts/digest.py:generate_html → assets/report_template.html 的 renderCards/renderTable 读取并插入到页面）。