quark-hub

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These are Quark Cloud Drive share/API links (including password-protected share URLs and personal cloud hosting endpoints) which are a common vector for distributing arbitrary binaries and malware because they can host user-uploaded executables and obscure content behind passwords or redirects.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 在 quark_hub.py 的 ls-share/tree-share 命令中，代理直接读取用户提供的分享链接参数 share_url，并在 get_stoken() 与 get_share_detail() 里将其对应的分享页文件列表数据（文件名等可包含自由文本）作为 LLM 可读内容输出/处理。