initiation-of-coverage-or-deep-dive

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill at runtime POSTs the user's query to https://ai-saas.eastmoney.com/proxy/app-robo-advisor-api/assistant/write/initial-coverage and then directly uses the returned JSON fields (title, content, pdfBase64, wordBase64, shareUrl) as the report content, so this external endpoint directly controls the agent's output and is a required runtime dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I searched the provided skill code for literal credentials. The script defines EM_API_KEY = os.environ.get("EM_API_KEY", "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg").strip() — a default, hardcoded, high-entropy API key-like string ("em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg") that is directly sent in request headers ("em_api_key": EM_API_KEY). This meets the definition of a secret (an actual API key).

No PEM/private key blocks or other high-entropy credentials were found. Items such as environment variable names, endpoints, or simple example strings were ignored per the rules.