queue-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). source runtime path: 云函数 cloudfunctions/queue-skill-handler/index.js 在 handleSearchStores({ keyword })、handleGetStoreQueueStatus({ storeId })、handleTakeQueueNumber({ storeId, ... })、handleGetQueueProgress({ ticketId }) 中直接读取由用户通过技能 API 调用传入的自由文本/标识（尤其是 searchStores 的 keyword），从而使外部用户可将任意文本注入到后端处理链路里（即便没有外部URL抓取）。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for high-entropy, literal credentials per the provided rules. The only candidate that meets the "literal, non-placeholder, random-looking value" criterion is the CLOUD_ENV_ID value ('cloud1-5g39elugeec5ba0f') in utils/util.js. It is a concrete cloud environment identifier used directly in wx.cloud.init({ env: CLOUD_ENV_ID }) and is not a generic placeholder or example string, so it may be sensitive (environment identifiers can be used to reference cloud resources). All other strings are either obvious examples, simple/static names/IDs (store IDs like "S001"), UI text, or configuration placeholders which per the rules should be ignored.