podcast-workflow

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a Feishu "父节点 Token" value and shows it being passed verbatim as a command-line argument to save_to_wiki.py, which forces the LLM/agent to output the secret token directly (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该技能的运行路径主要是用户提供/选择的 YouTube 链接后进行字幕提取（Step 1），并且在入口 A/入口 B 中都不会对“外部任意文本/评论/邮件正文”等进行非选择式读取。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for high-entropy literal values that could be usable credentials. I found a single high-entropy string "TOSJwKzxTiFdiRk0aducHNBFntg" which is explicitly labeled "父节点 Token" and used as the --parent argument in the save_to_wiki command. This appears to be a real token/identifier (not a placeholder like YOUR_API_KEY) and therefore qualifies as a secret under the definition.

Other values in the docs (local file paths, YouTube IDs, example URLs, simple words or sample placeholders) are either non-sensitive, clearly example text, or low-entropy and were ignored per the rules.