zhihu-clippings-vp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill shows placeholders and examples that pass API secrets directly on the command line (e.g., --access-secret "<access_secret>") and includes API key placeholders, which would require the agent to include secret values verbatim in generated commands or outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). scripts/clip_zhihu_official.py ingests outsider-authored free text from user-supplied clues/files (e.g., --title-source file, --extra-query-file, --input) to generate search queries, but it does not directly read arbitrary outsider free-text into the final clipping without first selecting Zhihu content and retrieving provider-authored article/answer bodies.