weibo-trends-analyzer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt includes a hardcoded API key (4dfdf794141101d7bb8ece0294dbbc02) directly within URL query strings in the prompt instructions and example commands, exposing the secret value verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow fetches real-time Weibo trending topics via API and performs web searches for background information on each topic, ingesting outsider-authored social media discussions and news articles.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references an external commercial API endpoint (TianAPI) used at runtime to fetch live Weibo trending data, but this intermediary service is operated by a recognized commercial vendor without any structural bypass of security controls, making it a common/reputable unofficial operational dependency.