huashu-design

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Multiple direct download links point to GitHub release assets hosted under a user repo (direct file downloads like .gif/.mp4) — while many are media, GitHub releases from third‑party user accounts are a common vector for distributing malicious binaries or tampered files if the source is not trusted.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md 的运行流程要求在“涉及具体产品/技术/事件/人物”时执行 WebSearch 并“读 1-3 条权威结果、确认存在性/发布状态/关键规格”，这会把公网上抓取的网页/搜索结果的可读文本（outsider-authored）进入 agent 的上下文，从而存在间接提示注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs using remote JS CDNs that will be fetched and executed at runtime (e.g. React/Babel from unpkg and Popmotion): https://unpkg.com/react@18.3.1/umd/react.development.js, https://unpkg.com/react-dom@18.3.1/umd/react-dom.development.js, https://unpkg.com/@babel/standalone@7.29.0/babel.min.js, https://unpkg.com/popmotion@11.0.5/dist/popmotion.min.js — these are runtime external dependencies that execute remote code and are presented as required for React/Babel prototypes.