industry-research-report

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Step 2 调用 scripts/get_data.py，该脚本通过 httpx 在运行时向 MCP_URL（外部服务）POST query，并把返回的 result.json() 中的 data.content（以及在为空时从返回的 wordBase64 解码出的 DOCX 文本）作为 truncated_text 进入 Skill 的最终 LLM 上下文/输出。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime script scripts/get_data.py makes a live POST request to https://ai-saas.eastmoney.com/proxy/app-robo-advisor-api/assistant/write/industry/research and uses the returned title/content/base64 attachments directly as the report text and attachments (a required dependency for the skill), so external content from that URL controls the agent's output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The script contains a hardcoded default API key assigned to EM_API_KEY:

EM_API_KEY = os.environ.get("EM_API_KEY", "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg").strip()

This is a literal, non-placeholder, high-entropy value (looks like an actual API key) and therefore should be treated as a secret. Other values in the file (environment variable names, default paths, URLs, example messages) are either non-sensitive, obvious placeholders, or low-entropy examples and are ignored.