lingzao

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Lingzao’s required runtime workflow for this skill includes live lookup of public Xiaohongshu/Douyin/WeChat content (e.g., search-notes, get-user-posted-notes, get-note-detail, get-note-comments, get-article-detail), which ingests outsider-authored free text (post captions, article body text, and comments) into the agent’s LLM context for analysis.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs at runtime to download and ingest an external Markdown file via the command curl -L "$subtitle_markdown_url" -o /tmp/lingzao-profile-subtitles.md (i.e. whatever URL appears in data.artifacts.subtitle_markdown.url), which would be fetched during execution and then used for subtitle/copy analysis — satisfying the conditions for a runtime external dependency that can directly control prompts.