nifs-archive-download

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This prompt extracts a JWT from browser sessionStorage and instructs embedding that token verbatim into shell/subagent commands and arguments (curl and batch scripts), which requires the LLM to handle and output a secret directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text is fetched at runtime from the public site archives.nifs.ac.jp via curl (signed URL and API responses like /api/catalogs/{id}/url and /api/catalogs/{id}), and the script ingests the returned text (e.g., signed_url body) into the agent’s execution context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls the runtime endpoints https://archives.nifs.ac.jp/api/catalogs/{id}/url and https://archives.nifs.ac.jp/api/catalogs/{id} to fetch signed URLs and identifiers which are then directly interpolated into subagent Bash prompts (curl commands) that are executed, so external content controls the agent's executed instructions.