skill-seekers

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit example API keys/tokens (e.g., export ANTHROPIC_API_KEY=sk-ant-..., export GOOGLE_API_KEY=AIzaSy...) and shows commands that embed those values, which encourages or requires handling secrets verbatim in output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly scrapes and ingests open/public third‑party content (e.g., SKILL.md and references/cli-commands.md show commands like "skill-seekers create https://react.dev", "scrape", "github", "video", RSS, and Slack/Discord exports) and then reads and AI-enhances that content as part of the pipeline to generate skills, so untrusted web/user-generated content can materially influence tool behavior.