source-audit
外部证据信源卫生中档闸门。 Use when: 准备引用外部 claim，且命中数字/百分比、benchmark、因果归因、趋势判断、模型能力对比、论文/医学/金融、或会落 docs/ADR/PPT 的高风险特征。 Not for: 简单事实查询、只读官方一手文档且不做外推、已经进入 deep-research 的重调研。 Output: claim ledger + verdict（use / use-with-caveat / reject / escalate-to-deep-research）+ provenance 行。
80
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md 第9-16行描述的运行时工作流是“把外部 claim 写进回复/research/PPT/ADR…并进行审计”，其中的“原始来源”与“追一手来源/补 WebSearch”会把运行时检索到的网页/他人博客文本（outsider-authored free text）读入并纳入 LLM 上下文进行 verdict 判断，因此存在间接提示注入风险。
- Repository
- zts212653/clowder-ai
- Commit
80782c5
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.