github-trending

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill fetches public GitHub repository READMEs and metadata from arbitrary trending projects, which can contain outsider-authored text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The file send_wecom_summary.py contains a hardcoded Enterprise WeChat webhook URL with a specific query parameter token (key=45548262-1f73-40a9-a33f-eba95e934082). This token provides direct access to send messages through the corporate webhook bot, making it an active secret leakage.