scholar-agent

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes an explicit CLI option to paste a session cookie value (scholar-inbox login --cookie VAL) and describes copying cookies from DevTools/session.json, which instructs embedding secret credentials verbatim into commands or outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches papers from the Scholar Inbox REST API and batch-adds public arXiv URLs as sources to NotebookLM (see SKILL.md Phase A Step A4 and Phase B and README examples like notebooklm source add "https://arxiv.org/abs/..."), and then reads/queries those ingested third‑party (user-authored) pages to drive classification, summaries, and follow-up actions—so untrusted web content can materially influence tool use and decisions.