zhihu-fetcher

Warn

Audited by Snyk on Jun 16, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.85). 在 fetch_zhihu_batch.py 的运行时路径中,脚本通过 Playwright 访问知乎页面并执行 page.evaluate 读取页面 DOM(contentEl.innerHTML/innerText),将“知乎正文/作者/标题等外部网页文本”转成 Markdown 写入 LLM 上下文(间接注入风险);该文本属于非操作用户选择引入的外部网页内容。

Issues (1)

W011
MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 16, 2026, 03:24 PM
Issues
1
Security Audit — snyk — zhihu-fetcher