research-topic-extractor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 该 skill 的运行时工作流在输入为“URL”时会调用网页读取工具抓取网页正文/内容并将其作为可读文本喂给 LLM（公共 web content fetched at runtime → outsider-authored free text）。

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The prompt directs the agent to write bug records to the user's home directory and to invoke local tools (gh and bensz-collect-bugs) to upload reports—actions that modify the filesystem and perform network/git operations—but it does not request sudo, system-level config changes, or creating users, so the risk is present but limited.