xyq-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 在路由 D（后端 Agent 编排）下，用户在 submit_run.py 的 --message 作为自然语言被发送到 POST https://xyq.jianying.com/api/biz/v1/skill/submit_run，随后技能在路由轮询中通过 get_thread.py/xyq_common.get_thread 读取该会话的 entry_list 内容并返回给 LLM 侧使用（messages/content/assistant/tool calls）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime Python code calls the XYQ backend API at https://xyq.jianying.com (default XYQ_BASE) to fetch messages/entries that can include assistant instructions and tool-calls which directly drive agent behavior, and those API calls are required for the skill to operate.