dynamsoft-sdk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s DBR template-optimizer runtime ingests outsider-provided image sets and optional ground-truth JSON at template-optimizer/SKILL.md → template-optimizer/resources/harness_py/main.py (e.g., --images <dir>, load_ground_truth()), and then renders decoded text into an HTML report via report_template.html.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a literal Dynamsoft license string found in multiple places. It is a non-placeholder, high-entropy-looking license value (DLS2eyJvcmdhbml6YXRpb25JRCI6IjIwMDAwMSJ9) that is used directly in sample code / a TRIAL_LICENSE constant to initialize LicenseManager.initLicense(...). Although labeled a "trial key" in comments (and may be expired/public), it is a real credential literal present in the repo and thus matches the definition of an actual credential. I ignored obvious placeholders such as "YOUR_LICENSE_KEY", "YOUR-PRODUCT-KEY", and other template placeholders elsewhere.