shodan-reconnaissance

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains multiple examples that embed the API key directly into commands/URLs or code (e.g., shodan init, curl ?key=..., Shodan('YOUR_API_KEY')), which requires the LLM to include secret values verbatim and is an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the Shodan API/CLI runtime path ingests outsider-authored free text when the user supplies an arbitrary Shodan search query or target (e.g., shodan search QUERY, shodan download ... "QUERY", or curl ... query=apache / api.search(query)), meaning attacker-controlled text becomes an input to the workflow and can be used for indirect prompt injection-style attacks via query strings or downloaded results content.