analyze-x-subscriptions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). Yes: the required workflow runs scripts/build-analysis-eval.mjs which injects an evaluate_script into an authenticated x.com page, where it reads and incorporates GraphQL JSON responses (e.g., creator account name/screen_name fields and any errors[].message text) into the returned object that the agent then formats as plain text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found a high-entropy, literal authorization token hardcoded into the emitted evaluation script. The string at scripts/build-analysis-eval.mjs:75 is long, randomized-looking, and used as the Bearer token in the authorization header — it qualifies as a real credential and should be treated as a secret.

Other candidates in the repo (the GraphQL query IDs at scripts/build-analysis-eval.mjs:8-9 and the default handles in references/default-handles.json) are not flagged: the query IDs are internal/unstable identifiers (not access credentials) and the handles are public account names. The code also reads the CSRF token from cookies at runtime rather than hardcoding it, so that is not a leaked secret in the repository.