late-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt's examples show embedding an API key directly in curl Authorization headers (e.g., -H "Authorization: Bearer YOUR_API_KEY"), which encourages including secret values verbatim in generated commands or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's rules/tools.md explicitly exposes endpoints that download public social media content and fetch YouTube transcripts from arbitrary URLs (e.g., /v1/tools/instagram/download?url=... and /v1/tools/youtube/transcript?url=...), meaning the agent can ingest untrusted, user-generated third‑party content that could contain instructions influencing its actions.