douyin-weekly-surge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow queries an external API (RedFox Hub) for Douyin trending content rankings, returning untrusted user-generated content (video descriptions, titles, and author nicknames) into the agent's context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installation of a remote npm package (@alipay/agent-payment) from an external ecosystem registry during setup/runtime without enforced integrity verification, establishing a weak/unknown operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill implements a direct financial operation: recharging API credits via Alipay when insufficient funds are detected (cashierUrl, payment signaling, submission, and polling). However, there is no independent access validation enforced by the service or execution layer for this payment route; the agent handles the recharge trigger and monitoring flow directly without qualifying independent authentication/authorization checks on the payment execution itself. This constitutes a direct operation without established qualifying control, resulting in a high severity rating.