didi-ride

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, scripts/didi.py fetches DiDi MCP responses over HTTP (including SSE data: {...} chunks) and parses/prints any returned content[].text from the remote server, which is outsider-authored free text that can be injected into the agent’s LLM context via the tool output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime helper contacts the DiDi MCP server at https://mcp.didichuxing.com/mcp-servers to fetch tool schemas and responses (via MCP protocol), and those remote responses directly control which tools/parameters the agent uses to form prompts and perform actions.