topic-research-report

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via the runtime HTTP response body: generate_topic_research_report() calls _http_call_topic_research(query) to POST to TOPIC_RESEARCH_URL, then _extract_content(raw) pulls data.content/displayData/answer/summary (server-provided text) and returns it as result["content"], which the skill outputs into the agent’s LLM-visible context.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the provided SKILL.md and scripts/get_data.py for hard-coded credentials.

Findings:

• The script defines EM_API_KEY = os.environ.get("EM_API_KEY", "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg").strip(). The fallback/default value "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg" is a literal, non-placeholder string with high entropy and the structure of an API key (prefixed "em_"). This appears to be an actual usable credential hard-coded into the code and should be treated as a secret.

No other high-entropy literals, private keys, or passwords were present. Other values (URLs, file paths, TIMEOUT_SECONDS, and doc strings) are non-sensitive. There are also comments prohibiting hard-coding, but that does not negate the presence of the default API key.

Therefore I flag the EM_API_KEY default as a real secret.