tencent-docs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly supports a "网页剪藏" workflow in references/workflows.md that requires calling scrape_url and scrape_progress to fetch arbitrary user-provided webpage URLs and automatically save/read their content, exposing the agent to untrusted public web pages that could carry indirect prompt injections.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly calls scrape_url at runtime to fetch arbitrary user-provided webpages (e.g., "https://example.com/article") and automatically injects that fetched content into documents / as reference_context (which the agent then uses), so external URLs provided by users can directly control agent prompts and outputs.