xhs-writer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and ingest open/public third‑party content (e.g., GitHub READMEs, web search results and web pages) via Step 2 "采集外部参考" (references/reference-search.md) and the README/agents/openclaw.yaml (uses WebSearch/WebFetch and curl to save fetched pages into reference/), so untrusted user‑generated web content is read and used to drive writing decisions and synthesis.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install instructions explicitly ask an agent to fetch and run remote code (e.g., "git clone https://github.com/JuneYaooo/xhs-writer-skill.git" and then "bash install_as_skill.sh"), and the README even suggests providing the raw install doc URL (https://raw.githubusercontent.com/JuneYaooo/xhs-writer-skill/main/docs/install.md) to an AI installer — which is high-confidence evidence that external content would be fetched at runtime and can execute code.