js-secrets-extraction

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs searching, extracting, printing, and using discovered API keys/secrets (via grep/print and curl requests), which requires the agent to read and output secret values verbatim, creating an exfiltration risk.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content is a clear offensive reconnaissance toolkit for harvesting hardcoded secrets, source maps, and internal backend URLs and includes active verification/exploitation steps — enabling credential theft and attack surface discovery.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow in scripts/scan_js.py fetches and ingests attacker-controllable HTML/JS content from an arbitrary source URL provided at execution time (it then scans the downloaded r.text and jr.text for regex-matched secrets), creating indirect prompt-injection exposure if an outsider can influence the URL content.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal high-entropy string "AD5oDjsJaTJOzLe1Llj9mz" because it appears verbatim in the documentation as an "Encryption keys" value (no ellipsis, redaction marker, or clear placeholder). It is random-looking and meets the definition of a secret (could provide access to encrypted data/services).

Ignored items and why:

• "AIzaSy...2GXA" (SKILL.md) — truncated with ellipsis, clearly redacted/truncated, so ignored per rules.
• Supabase hostname "jxhvjufqtabpeieyhkgk.supabase.co" — a backend URL/project identifier (intel) but not a credential granting access, so not flagged.
• Placeholder strings like "ANON_KEY", "AIza...", "dpl_BCoyPsxxYLZ..." and other examples in the doc are either placeholders, truncated/redacted, or explicitly public deploy IDs and thus ignored.
• scripts/scan_js.py — contains regex patterns and examples but no hardcoded high-entropy credentials.

Because a high-entropy, literal key appears, I mark this as a secret present.

---

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a targeted secret-extraction tool that explicitly hunts for payment-related credentials: it includes regex patterns for Mercado Pago and Stripe keys and searches for "payment" routes in admin JS bundles. Because it specifically targets payment-gateway credentials (which can enable direct financial execution), this qualifies as Direct Financial Execution capability.