read-url

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow can ingest outsider-authored content by fetching arbitrary user-supplied URLs and extracting their readable text (e.g., generic pages via curl/defuddle parse, and additionally Zhihu articles by headless browser extraction in scripts/fetch_zhihu.py).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly fetches raw repository files at runtime (e.g. https://raw.githubusercontent.com//// and https://huggingface.co///raw/main/README.md) to load page content into the agent context, which can directly control prompts and is therefore a high-confidence prompt-injection vector.