laohan-xiazai

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill contains guidance that weakens security boundaries (MITM proxy with CA installation, direct CDP access to the user's Chrome, anti-detection/stealth scraping and automation techniques) that enable privacy-invasive scraping without clear malicious intent.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill points to a GitHub release (https://github.com/hanzhcn/laohan-skills/releases/tag/v1.2.0) that distributes a wechat-video-download binary which implements a local MITM HTTPS proxy and instructs installing a custom CA (SunnyRoot.cer) to decrypt traffic, a high-risk delivery method though hosted on GitHub.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md 将“评论采集/搜索聚合/网页抓取”作为运行时关键能力，并在场景B/降级链中直接读取用户提供的任意社交平台链接与搜索结果（agent-reach、Jina Reader、web-content-fetcher、Scrapling stealthy_fetch 等会摄入外部自由文本）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill calls Jina Reader at runtime via curl to "https://r.jina.ai/" (SKILL.md:179), which fetches arbitrary external webpage text that is injected into the agent context and can directly control prompts/responses.