agent-reach

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill contains explicit examples that pass API keys, cookies, and passwords directly on the command line (e.g., proxy http://user:pass@ip:port, twitter-cookies "auth_token=xxx; ct0=yyy", groq-key gsk_xxxxx), which would require the LLM to output secret values verbatim and thus creates high exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most URLs are benign content/API endpoints (v2ex, Bilibili, WeChat, r.jina.ai proxy, Groq console, example.com, localhost), but the skill also instructs installing/running code from unvetted third‑party sources (pipx install from a GitHub main.zip, pip install git+https, Docker image xpzouying/..., GitHub release API links and repo archives), and includes short links and a credential-containing URL — installing or running code from these untrusted sources is a real malware risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow can fetch and ingest outsider-authored free text from public web pages via the “web” category (e.g., curl -s "https://r.jina.ai/URL" and web-reader.webReader(url: ...)), which reads arbitrary third-party page content into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The preflight script runs pipx install https://github.com/Panniantong/agent-reach/archive/main.zip at runtime, which fetches and installs remote Python package code that is then executed/used (agent-reach CLI) and is a required dependency for the skill, so this URL is a runtime-executed external dependency.