alphaear-news

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow fetches hot news and social feed content from public aggregation APIs (NewsNow) and community platforms like Weibo, Zhihu, and Hacker News where outsiders can freely post comments and articles.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill makes runtime requests to external API services (NewsNow and Jina Reader hosted on third-party domains) to fetch configuration, instructions, or behavior-selecting content during execution, and these untrusted third-party endpoints lack official enterprise provenance or cryptographic verification.