instagram

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). O fluxo de leitura de conteúdo em tempo de execução consulta texto autoral de terceiros via Graph API (ex.: comentários em scripts/comments.py → scripts/api_client.py:get_comments retornando text, e menções/threads em scripts/messages.py → scripts/api_client.py:get com fields=...message...).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal, high-entropy credentials. I found a hardcoded Imgur client identifier (string of hex-like characters) that is directly used in an Authorization header for uploads — this is a real API credential rather than a documentation placeholder.

I ignored other values such as example numeric IDs (e.g., "17841400000000") and placeholders like "seu_app_id"/"seu_app_secret" and environment-variable examples because they are low-entropy examples or documentation placeholders per the rules.