maxhub-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two URLs point to a small/individual GitHub user and their GitHub Pages site hosting a video-decryption tool — third-party repos/pages by unknown authors can distribute scripts or binaries that may be malicious or abused to deliver malware, so they are suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). maxhub-lemon8 的运行流程会基于用户输入的查询词/话题名去调用 Lemon8 的公开内容与评论接口（如 fetch_search、fetch_post_comment_list 等），从而在 LLM 生成摘要/分析时读取由第三方用户撰写的文本（帖子标题/评论正文等）。