read-x-markdown

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—at runtime the skill fetches outsider-authored X content (tweets/articles) via public network calls (e.g., fetchHomeHtml/fetchText/GraphQL fetch), then converts the returned text/HTML/JSON into markdown and passes it into the agent’s LLM context as readable prose (the produced markdown body/frontmatter).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for high-entropy literal values that could grant access.
• Flagged: scripts/constants.ts contains a long, literal "Bearer ..." token assigned to DEFAULT_BEARER_TOKEN (lines 3–4). This is a high-entropy authorization token and qualifies as a secret (it can be used as an API bearer token).
• Ignored items: fallback IDs and feature-switch strings (e.g., FALLBACK_QUERY_ID, FALLBACK_TWEET_QUERY_ID) are identifiers that do not grant access; user-agent strings, environment variable names (X_AUTH_TOKEN, X_CT0, X_BEARER_TOKEN, etc.), cookie name lists, and small/example passwords/placeholders are not secrets per the rules and were not flagged.

Therefore there is one real secret present (the embedded bearer token).