huawei-cloud-voucher-assistant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow consumes outsider-authored free text from community tasks via scripts/data/hdcommunity_client.py and BSS coupon records via scripts/data/coupon_api.py, which are monitored sources where external entities can publish or submit text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes setup/runtime scripts (ensure_cli.sh and install_cli.sh) that fetch an external package installer from arbitrary/unverified remote infrastructure (devdata.myhuaweicloud.com and obs-skills-repository.obs.cn-north-4.myhuaweicloud.com), representing a weak third-party operational dependency.