agent-reach

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs users to paste cookie/header strings and shows examples that embed tokens and credentials directly in CLI commands (e.g., cookie header, proxy with user:pass, xsec_token), which requires the agent to receive and output secrets verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly instructs users (and provides an automatic option) to extract and transmit browser authentication cookies and proxy credentials to the agent, and it encourages installing third‑party packages directly and using proxies to evade blocks — patterns that enable credential theft, account takeover, and covert data exfiltration (supply‑chain risk present as well).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). This skill explicitly directs the agent to fetch and parse untrusted, user-generated public content (e.g., "Twitter/X (xreach CLI)" commands, curl to "https://www.reddit.com/...", yt-dlp for YouTube/Bilibili, LinkedIn/job sites, and "Web — Any URL (Jina Reader)" in SKILL.md), so the agent will read and act on arbitrary third‑party webpages and social posts that could carry indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup step requires pip installing and thus executing code from the remote archive https://github.com/Panniantong/agent-reach/archive/main.zip, which is a required runtime dependency that can execute arbitrary remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). This skill tells the agent to install system-wide dependencies (Node.js, global npm packages, CLIs via pip), install/start services, and extract browser cookies—operations that modify the host state and may require elevated (sudo) privileges even though it does not explicitly request creating users or editing system files.