job-apply

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill uses a browser control interface (such as Kimi WebBridge or browser automation) to read recruitment web pages and job application forms supplied by the user or specified URLs, which exposes the agent to arbitrary outsider-authored free text from job descriptions and web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains setup instructions that use curl and irm to fetch and execute remote scripts from cdn.kimi.com at runtime, specifically curl -fsSL https://cdn.kimi.com/webbridge/install.sh | bash and irm https://cdn.kimi.com/webbridge/install.ps1 | iex.