dot-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs users to provide API credentials (app_id/app_secret, user_access_token, tenant_access_token, etc.) and shows/example commands and API calls that embed those secrets directly (e.g., Authorization: Bearer {user_access_token}, --user-token {user_access_token}), which would force an agent to include secret values verbatim in outputs/commands.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository contains explicit tooling and step-by-step instructions to obtain and use OAuth app credentials and user tokens to automatically collect private chats, documents, and other user data (including guidance to script message-sending to obtain chat IDs and to run collectors with user tokens), which enables high-risk data collection/exfiltration and credential handling that can be abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s “Step 2: 原材料导入” explicitly allows user-provided text/file uploads (including “飞书链接/浏览器登录态” and “邮件 .eml / .mbox” exports) to be parsed and then read at runtime, so an outsider can supply free-form content into the workflow’s ingestion path (e.g., paste/upload) and have the LLM ingest it.