harmonyos-linux-cli-dev

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md 的 Refresh Workflow 会在运行时从公共网页（developer.huawei.com）抓取并生成 Markdown 文档（scripts/fetch_harmonyos_commandline_pages.py 输出到 references/harmonyos-commandline-docs），这些网页正文属于“公共 web 内容”并会以可读文本形式进入技能内置引用文件，从而可能被后续 LLM 读取用于命令生成。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's refresh workflow runs a fetch script that retrieves the entry page at https://developer.huawei.com/consumer/cn/doc/harmonyos-guides/ide-commandline-get at runtime and uses the fetched pages as the authoritative command/reference material that directly shapes the agent's responses.