next-variant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md "功能一：网站风格反向提取 (URL → Skills)" Step 1 explicitly tells the agent to "用 browser/fetch 获取页面 HTML" and download CSS from arbitrary website URLs, and those extracted tokens are then interpreted to choose skill combinations and to generate prompts/code, so untrusted public webpage content is ingested and directly drives decisions and subsequent tool actions.