yyl-benchmark-breakdown

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 运行时会通过 scripts/prepare-assets.sh 调用本地下载 API（如 Douyin_TikTok_Download_API 的 api/hybrid/video_data?url=...、XHS-Downloader 的 /xhs/detail）或 Jina Reader (https://r.jina.ai/<url>) 抓取“用户提供链接对应的外部网页/作品内容”，并把返回的标题/正文/字幕/转写文本（如 audio.txt、metadata.json 中的文案）写入工作目录后进入后续 LLM 上下文。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime bootstrap (scripts/bootstrap-local-apis.sh and related check/start flow) will docker pull and run remote images that execute code on the host (notably evil0ctal/douyin_tiktok_download_api:latest and joeanamier/xhs-downloader, with the repo https://github.com/Evil0ctal/Douyin_TikTok_Download_API referenced), and those images are required dependencies for the main workflow, so remote content is fetched and executed at runtime.