wechat-channels-crawler

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill instructs the agent to trigger Alipay payments and automatically execute payment verification flow when API credits are insufficient, which constitutes executing financial transactions and weakening payment controls against the user's resources.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow queries a WeChat Channels search API that returns user-generated video titles, descriptions, and author names created by random platform users.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill references an external npm package installation command (npx -y @alipay/agent-payment@latest install) for runtime dependency setup, presenting a weak/unknown third-party publisher operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents a direct financial operation involving payments: when the API returns an insufficient points error (code=3210), the agent automatically invokes Alipay to complete the recharge process using cashier URLs and payment submission/polling tools described in SKILL.md:235-241. There is no independent access validation or secure authentication mechanism enforced by the execution layer for this direct payment step; it relies entirely on the agent following instructions and triggering payment signals. Therefore, it is a direct operation without established qualifying control, resulting in high severity.