xiaohongshu-card-notes
Warn
Audited by Snyk on May 11, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The skill makes runtime requests to the PostPlus hosted capability API (e.g. ${config.apiBaseUrl}/api/postplus-cli/hosted/capability and ${auth.apiBaseUrl}/api/postplus-cli/auth/refresh) via runHostedCapabilityEnvelopeRequest/requestHostedCapabilityApiJson, which executes hosted capabilities and returns outputs that directly control the skill's behavior.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata