twitter-video-downloader

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples that place API keys directly into shell commands and config files (e.g., export REDFOX_API_KEY=ak_..., python with --api-key, and echo to a JSON file), which requires handling or outputting secret values verbatim and is therefore high risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Category: public network/API response from a third party (redfox.hk) — the skill calls requests.post(... ) and then prints/serializes result fields like desc and resources, which are free-form text originating outside the operating user, into the runtime output that the agent would include in the LLM context.