chen-yiwei-perspective

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required Agentic Protocol explicitly mandates "必须查阅准则原文" and the "查阅规则（本地优先）" states that on cache-miss the agent must use a webReader to fetch content from the public site docs.maoyanqing.com (and the skill's sources include forum Q&A), so the agent will autonomously fetch and act on untrusted third‑party web content that can change its decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires at runtime fetching authoritative standards from docs.maoyanqing.com (e.g., https://docs.maoyanqing.com/accounting/ent/cas/{XX}.html) via its webReader/cache-update procedure and uses that fetched content to drive prompt context and final answers, so this external URL is a runtime dependency that directly controls agent instructions/outputs.