x-article-draft-uploader

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Two URLs use typosquatted hostnames (x.com.evil.example and twimg.com.evil.example) that impersonate legitimate services and are high-risk for credential phishing or delivering malicious content.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill 会把用户提供的本地 Markdown 解析/渲染为 rich text 并在 X 的作文章编辑器中粘贴（运行路径：scripts/upload_markdown_to_x_article.py 解析/构造正文与富文本后对 composer 进行填充），因此会直接摄入并执行用户/外部提供的自由文本。