xiaohongshu-video-downloader

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow takes user-supplied Xiaohongshu video links and processes them via an external API (redfox.hk), which returns parsed video metadata and description text into the LLM context; however, because the user explicitly selects and provides the specific link URLs, this falls under active fetching/user-selected content rather than an unmonitored feed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill executes runtime API calls to redfox.hk at setup and runtime (scripts/downloader.py), using a third-party, unrecognized, and commercial-adjacent service whose ownership and distribution are not established (high tier).