linkfox-jiimore-get-niche-info-by-keyword

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The line pointing to https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip is suspicious because it is a direct downloadable archive that the skill instructs users to download and install (a common vector for distributing malicious payloads), while the other URLs are API endpoints or documentation which are lower risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Required workflow calls an external API and then prints/saves the API’s JSON response (which is outsider-authored data) into the agent runtime context via stdout (full JSON when ≤8KB or with --inline, otherwise a summary with sampled free-text fields like nicheTitle/translationZh).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill directs the agent at runtime to download and install remote code from https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip as a fallback onboarding skill, which fetches and installs executable skill content that can change agent behavior.