huawei-cloud-find-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Yes—runtime HTTP GET from GitCode API v5 loads index.json and cn-en-map.json (base64-decoded) from a third party, and scripts/search-skills.py turns their JSON fields (e.g., descriptions, triggers, names) into readable text printed/used in the agent’s flow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches and decodes runtime content from external endpoints (e.g., https://gitcode.com/api/v5/repos/2501_91318609/skills-for-index/contents/skills-index/index.json?ref=main and https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills/${category}/${service}/${name}/SKILL.md), which are requested during execution and are used to determine/search/return skill details (i.e., injecting external content into the agent's responses), so they directly influence agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly instructs installing system packages with sudo (e.g., "sudo apt-get install python3") and to run installation commands (npx skills add) that modify the host environment, so it directs actions that change the machine state and may require elevated privileges.