tech-insight-report

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该Skill在Phase 2/3/4通过Web Search（Web Search MCP + web_fetch）采集市场数据、科技新闻与近期动态，并将检索到的网页/新闻正文等外部自由文本纳入LLM写作与质检流程，存在用户可发布/投喂的间接提示注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The HTML skeleton (references/html_skeleton_template.html) includes a runtime which fetches and executes remote JavaScript (Chart.js) in the viewer's environment, i.e., a required runtime external dependency that executes remote code.