soia-pkm-alipan-curator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several URLs point to personal cloud file-hosting deep-links (aliyundrive / alipan) and one is a malformed/ambiguous host ("https://alipan") — patterns commonly used to share executables or to typosquat/obscure destinations, so these are suspicious; the GitHub documentation link is benign documentation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在运行时会读取并解析用户在本次请求中提供的学情描述/成绩截图内容并据此生成学习计划（plan 工作流：SKILL.md 的“plan—学习计划”输入与诊断映射、以及过程会写入学习计划模板字段），因此外部作者的自由文本/内容可直接进入 LLM 生成链路。