qinghu-shipinhao-videos

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill queries data from a WeChat Channels video list API via a CLI tool, and the returned video data or metadata may contain outsider-authored free text (such as video titles, descriptions, and comments) which is processed by the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill executes paid API tool calls using credits (qhkit mcp call and credit estimation/billing), which constitutes an indirect financial operation (submitting billable usage/API charges). Therefore, access-control review for direct operations is not required.