visual-ops-writer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 在 mode=link_rewrite 下，运行时会通过 scripts/fetch_article.py --url <sourceUrl> 抓取“用户提供的任意文章 URL”的网页正文与图片 URL，并把抓取到的章节文本（外部作者内容）喂给后续 LLM 生成流程，属于“公共 web 内容/外部文章正文”进入 LLM 上下文的间接提示注入风险路径。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches arbitrary user-provided article URLs at runtime via scripts/fetch_article.py (user-supplied sourceUrl starting with http/https) which are parsed and injected into LLM prompts (link_rewrite mode), and it also submits/uses remote image-generation endpoints (e.g., https://redfox.hk/story/api/parseWork/imageGen/submitSkill and https://redfox.hk/story/api/parseWork/imageGen/uploadImage) during runtime — meaning external content/URLs directly control prompt/context and trigger remote execution.