ai-clipping

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly asks the agent to request and set the WAYIN_API_KEY (e.g., "Set WAYIN_API_KEY=<your_key>") and to include it in environment-setting/run commands, which requires the LLM to handle and potentially emit the secret value verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill accepts public video URLs (YouTube, TikTok, etc.) and uploads/ submits them to the external WayinVideo API and then reads and acts on the API's result JSON (see SKILL.md Steps 1–5 and scripts/submit_task.py / scripts/polling_results.py), thereby ingesting untrusted user-generated content (videos/transcripts/metadata) that can materially influence agent decisions and actions.