zettaranc

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 摄入/Ingest 工作流在用户触发（如自然语言“把这个资料摄入知识库”、/ingest <path>）后会读取 raw/01-zettaranc/ 下的原始素材并提取其中文本写入 wiki/zettaranc/sources/、entities/、concepts/ 等页面，因此若外部用户能向该 raw 目录投递内容，就会把其免费文本暴露给运行时流程。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs gh API commands to fetch files from the GitHub repo "repos/chenleiitaz/zettaranc-knowledge/contents/..." at runtime (e.g. gh api "repos/chenleiitaz/zettaranc-knowledge/contents/wiki/index.md" --jq '.content' | base64 -d), and those fetched files are used to drive agent answers, so remote content can directly control prompts.