wechat-prohibited-word

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill contains an integrated automated payment workflow that commands an external CLI tool to handle recurring point charges and monitor billing callbacks via external endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow ingests outsider-authored free text via web page scraping (extract_from_web) and file reading (extract_from_file), where an external party can publish arbitrary web pages or send files that the agent automatically fetches and processes without user pre-selection of specific trusted items.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's scripts and configuration fetch and execute code from an external URL (redfox.hk), which constitutes an unverifiable runtime external dependency with weak/unknown provenance.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill includes a direct payment route triggered when API balance is insufficient (code=3210), invoking Alipay via a cashier URL and payment orchestration instructions (alipay-bot trigger-payment-signal -> submit-payment -> poll-payment-status). No independent, service-enforced access control or authentication mechanism is documented for the payment operation itself.