hhxg-market

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime code (scripts/_common.py) fetches JSON from https://hhxg.top/static/data which is used (e.g., the assistant/skill_snapshot.json ai_summary field) at runtime to generate and inject content into the agent's responses, and the scripts rely on that external data source.