video-understand

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow processes video content and transcripts from social media feeds (specifically Xiaohongshu notes and video links) via download tools and crawler utilities, which can contain outsider-authored text and video descriptions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The workflow references https://github.com/cyl19970726/multi-agent-harness as an external operational dependency (harness CLI) for executing workflow scripts, but this remote repository locator is an unofficial personal repository, making it an unverified runtime external dependency with weak/unknown provenance.