dingtalk-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该技能运行时从外部第三方（如 GitHub/邮件/工单/社区条目）读取的“免费文本”并不存在；其可读内容主要来自官方一体化的技能市场搜索/技能元数据与安装的结果（例如 dws skill search 返回字段中的描述等），而不是任意 outsider 投递到队列/订阅源再被无选择地摄取。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill install/search flow uses the skill API host at runtime (default https://mcp.dingtalk.com) to download skill packages which can contain remote code or instructions that will be installed/executed by the agent.