laohan-chuangzuo
Warn
Audited by Snyk on Aug 27, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). 在“URL 队列预处理”(Pre-B)中,工作流会从用户可写的
url.md读取未标记 URL 后“抓取内容”,将抓取到的网页/平台文本作为素材进入后续 Layer A/B 整理与口播写作,因此外部作者的免费文本可在运行时被 LLM 直接摄入。
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata