qiaomu-cut

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Multiple URLs contain embedded credentials, short-lived signed query tokens, or control/templating characters (e.g., user:pass@, ?api_key=..., ?X-Amz-Signature=..., control chars) which are high-risk patterns for leaking secrets or delivering private/signed downloads that attackers can use to distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High-risk: the vendored marswave "cola-avatar-pack" contains explicit instructions to write/delete files in the user home, run local scripts, and silently inject persistent behavior into AGENT.md (silent "injection" of runtime behavior), which constitutes a backdoor/persistence and supply-chain risk; other vendored skills also include silent config/file creation and background remote calls that increase abuse surface.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). 该技能的运行路径会在“Source/Generate”阶段通过 URL 提取/抓取的外部网页正文（outsider-authored free text）进入 LLM 上下文，例如在 SKILL.md:12-14/39 中提到“从 URL 提取脚本材料”，且其配套的 content-parser 会把抽取到的 content（自由文本）写入 {slug}.md 并用于后续生成。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit runtime curl calls to the ListenHub/MarsWave API (e.g. https://api.marswave.ai/openapi/v1/content/extract) which the agent uses to fetch extracted page/content that is then ingested into generation pipelines (directly controlling prompts/output) and requires the provider API key, so this is a high-confidence runtime external dependency.