google-dorks-catalog

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes literal API-key/token patterns (e.g., "sk-", "ghp_", "AKIA", "SG.") and example code that places a personal token into an Authorization header (GH_TOKEN) and curls .env files, which requires embedding or handling secret values verbatim and thus poses high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit catalog of search queries and commands to locate, retrieve, and verify exposed credentials and private keys on third-party sites and code hosts, enabling credential theft and data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill provides Google dork strings and GitHub Code Search API patterns intended to fetch/search for outsider-authored sensitive text (e.g., from public web pages and GitHub repositories), meaning the required workflow would ingest free text from those external sources once results/pages/code are retrieved.