alphaear-stock

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow fetches external stock market data, historical prices, and company descriptions from public financial APIs (such as yfinance and akshare), which can contain outsider-authored text in fields like company summaries.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill makes direct HTTPS requests to EastMoney APIs (push2his.eastmoney.com and push2.eastmoney.com) at runtime to fetch stock data and lists, which constitute unauthenticated external operational dependencies.