cliproxy-newapi-stack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 Skill 在运行时通过 scripts/verify_stack.sh 构造并发送包含用户给定/拼接 nonce 的 free-text prompt 到 CLIProxyAPI/NewAPI（payload 的 messages[].content），属于运行时 LLM 可读的外部文本暴露面。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The deploy flow requires pulling and running an external Docker image reference (calciumion/new-api@sha256:<VERIFIED_DIGEST>) at runtime via docker pull and docker run, which executes remote code provided by that image.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). Yes. The skill includes explicit, purpose-built billing operations: a script to directly modify user quotas (scripts/topup.sh), a script to write pricing (scripts/set_pricing.py), and explicit configuration for payment gateways (Stripe / 易支付) for online top-ups. These are specific financial-execution actions (crediting quotas and configuring payment gateways), not generic tooling.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs SSH as root and running scripts that modify /root/CLIProxyAPI/config.yaml, change firewall rules, deploy/restart containers, SCP files to the VPS, and edit SQLite quotas — all actions that change the machine state and require elevated privileges.