wiki

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 在运行时的 /wiki ingest <URL>（URL 导入）工作流中，技能会对用户提供的 URL 进行 WebFetch 抓取并把“抓取的原始内容”保存为 raw/<slug>.md，随后在同一次 ingest 里对该文本进行摘要与写入 LLM 上下文，因此会引入“公共网页/外部 URL 内容”的自由文本（间接提示注入风险）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches and ingests external web content at runtime (e.g., the example "add this Karpathy gist to the wiki: https://gist.github.com/karpathy/442a6bf555914893e9891c11519de94f"), and that fetched content is directly read and used as authoritative input to drive the agent's actions (prompting/synthesis), creating a prompt-injection risk.