soia-pkm-clip-rednote

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires preserving and passing the full share URL (including the xsec_token) as a command-line argument and storing it verbatim in frontmatter, which forces the agent to handle and output a sensitive token value.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Two URLs (attacker.example and evil.example) are suspicious because they are non-xiaohongshu domains that mimic Xiaohongshu share paths and could be used to exfiltrate cookies or deliver malicious payloads; the xiaohongshu and GitHub links are benign documentation/official sites.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在运行时会将用户提供的“分享链接/URL”（外部文本输入）发起 HTTP GET 并从返回内容中读取 window.__INITIAL_STATE__（含正文/作者等）进行解析与写入 Obsidian，因此外部作者可通过提交链接或注入内容影响被 LLM/脚本摄取的自由文本。