wechat-10w-hot
Warn
Audited by Snyk on Aug 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). 该工作流在运行时通过
scripts/fetch_10w_hot.py向https://doubaoya.com/api/apis/gongzhonghao/category-time-hot/call发起固定入参的 POST 请求并读取其返回 JSON 中的data.items（含title/accountName/readCount）用于生成表格，属于外部服务返回文本的直接摄取；虽然调用参数由闭集分类控制，但返回内容仍可能包含由第三方来源作者产生的免费文本。
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata