labarchive-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples and workflows that place API keys/passwords directly into config files and command-line arguments (e.g., config.yaml placeholders and a backup command using --password AUTH_TOKEN), which requires the LLM or agent to accept and embed secret values verbatim in generated commands or code, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests untrusted, user-generated content from third-party sources (e.g., Protocols.io in references/integrations.md and notebook backups that include entry HTML/content per references/api_reference.md), and the provided scripts (scripts/notebook_operations.py and scripts/entry_operations.py) parse that content and use it to create or upload entries/attachments—so external page/post content can directly influence actions.