xiaobao-flow2api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly instructs passing user-provided API keys or base URLs "through the command input JSON" and to "pass all request values through CLI arguments," which would require the LLM to embed secret values verbatim into generated commands/JSON (even though .env is preferred), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The bundled CLI (scripts/flow2api-cli) issues HTTP requests to a configurable base_url (via build_config/resolve_client and Flow2APIClient.post_json/post_stream) and then extracts text/URLs from responses and may download them (emit_result -> extract_urls -> download_urls), so arbitrary third‑party responses can be ingested and influence agent behavior.