xiaohongshu-write

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow retrieves external posts and user-generated notes from Xiaohongshu via an API script, exposing the agent to untrusted external text content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes references to install an external npm package from an arbitrary repository source (npx -y @alipay/agent-payment@latest install) during the runtime/setup flow, which constitutes an unverifiable runtime external dependency from an unofficial publisher with weak provenance.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents a recharge workflow triggered upon encountering insufficient API key balance (code=3210), invoking Alipay payment signals and submission steps (alipay-bot trigger-payment-signal -> submit-payment) to handle direct financial charges/purchases without independent access controls enforced by the service layer. This constitutes a direct financial operation without qualifying controls.