stock-diagnosis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 该技能在运行时将用户的自然语言问句发送到外部股票分析 API（_http_call_stock_analysis 对 STOCK_ANALYSIS_URL 发起 POST），并把 API 返回的 data.displayData/content 等可读文本直接作为 result["content"] 注入到代理的 LLM 上下文中；该文本属于外部服务生成的自由文本，存在间接提示注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes a runtime POST to https://ai-saas.eastmoney.com/proxy/app-robo-advisor-api/assistant/stock-analysis and directly uses the API's returned displayData/Markdown as the user-visible diagnostic report, so remote content controls the agent's outputs and is a required runtime dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the skill code for hardcoded credentials. The EM_API_KEY default value is a literal, high-entropy string ("em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg") assigned when the EM_API_KEY environment variable is absent. It is used directly in the HTTP request header ("em_api_key"), so it appears to be an actual API key (not a placeholder like "YOUR_API_KEY" or "sk-xxxx") and thus a real secret.

Other strings in the file (endpoint URL, default paths, numeric timeouts) are non-sensitive and were ignored. No private key blocks or other high-entropy secrets were found beyond the EM_API_KEY default.