dby-api

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow consumes publicly searched social media notes, articles, and trends via api.trend.hotSpotKeyword, api.gzh.searchArticle, api.xhs.searchNote, and similar endpoints where outside authors submit free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill is a data-fetching and fact-checking tool for new media content using the Doubaoya API (doubaoya.com) via an API key (DOUBAOYA_API_KEY). It documentation mentions that calling certain endpoints is billed (调用类端点必须带 Bearer 且计费), but the skill itself only performs data retrieval, searching, analysis, and API calls without executing direct financial transactions, payments, charges, or issuing financial instructions. Therefore, it is classified as indirect financial operation due to service billing (or no financial operation depending on service cost exclusion, but treating API usage billing as indirect financial scope), and since it operates via API authentication (Bearer token/API key), it falls under medium severity.