alphaear-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow performs web searches via Jina, DuckDuckGo, and Baidu, extracting and processing public web content into local databases and LLM prompts.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains hardcoded URLs for external services such as Jina Reader (https://r.jina.ai/), Jina Search (https://s.jina.ai/), DashScope (https://dashscope.aliyuncs.com/compatible-mode/v1), OpenRouter, and Z.AI (https://api.z.ai/api/paas/v4) which are contacted at runtime to fetch search results, extract web content, and route LLM calls without strong first-party verification of those endpoints.