ppt-master

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Several entries are placeholder/short/obscure domains and a clear typosquat-like domain (api.minimaxi.com vs api.minimax.io) or long nonstandard subdomains that can hide redirects or untrusted binaries, so they look suspicious and warrant caution before downloading or executing anything from them.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md’s required runtime workflow includes a web-acquisition path (“Web link” → web_to_md.py in Step 1, and Acquire Via: web in Step 5) that can fetch public pages and convert their body text into Markdown, which the agent then reads and uses as LLM context—an outsider-authored free-text source.