wukong

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's execution pipeline (SKILL.md → "蒸馏读 distillation.md") and the architecture/plans docs (docs/plans/2026-04-08-... and the distillation/sections) explicitly state that distillation transformations ingest public user-generated sources (e.g., "博主" data from Twitter/X and 小红书 posts and pasted chat logs), so the agent is expected to read and act on untrusted third‑party content (references/distillation.md and docs/plans), which could materially influence persona generation and subsequent actions—creating a clear avenue for indirect prompt injection.