wechat-account-analyzer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt tells the agent to "主动帮你配置" the REDFOX_API_KEY and shows export/SetEnvironmentVariable/echo commands that imply the agent may ask for the API key and embed it verbatim into shell commands or outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 运行时会调用红狐API https://redfox.hk/story/api/gzhUser/query 获取 works/description/accountName 等字段，并将其作为可读文本写入 output/report_data.json 后再由Agent直接渲染到LLM对话上下文（如“近7天作品标题/账号简介/相似账号名称”），这些文本属于第三方（非操作用户）来源。

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)