feishu-paper-reading

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). At runtime, the workflow ingests outsiders’ free text only indirectly as user-supplied topic/parameters (not as content from a queue/feed/chat/comment/email/Jira/GitHub issue/PR), while the other LLM-readable texts it reads are first-party/trusted (the selected papers themselves are fetched as research sources, not posted outsider strings into a monitored channel).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer helper scripts call the GitHub Releases API at https://api.github.com/repos/larksuite/cli/releases at runtime (see scripts/install_lark_cli.py), which the skill uses to download an official lark-cli release binary that becomes a required external executable the workflow may later run — i.e., remote code is fetched and installed for execution.