xiaohongshu-crawler

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow queries the RedFox API for Xiaohongshu posts via crawl_xhs.py, which retrieves third-party user-generated content (notes, titles, descriptions, and comments) authored by external platform users without agent selection.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill's description and workflow reference a payment recharge mechanism when API balance is insufficient (exit code 3, Alipay cashier URL, submit-payment, poll-payment-status). This represents a direct financial operation (charges/payments) executed via delegated payment tools. However, the documentation notes that this automated recharge/payment flow requires triggering via the separate alipay-bot framework and toolset, and no independent service-enforced access control is established within this specific skill file to validate or gate the payment instruction itself. Therefore, it is a direct operation without established qualifying control.