Most static alerts match Markdown, readable Chinese prose, or a credential check that reports only presence. The CLI examples execute an unpinned npm package with access to the agent environment. Polling lacks a time or attempt limit; no evidence found of credential exfiltration, encoded payloads, or audit-directed prompt injection.
The rules require polling until terminal status, tool failure, or user cancellation. A perpetually nonterminal job can consume ongoing requests and agent execution.
The text explicitly lists only three stopping conditions and gives no attempt or elapsed-time limit. Poll delays reduce request frequency but do not bound execution.
The fenced examples run npx -y socialdatax-skills@latest, allowing changing registry code to execute without an installation prompt. That code inherits the agent environment, including service credentials.
Of 54 static alerts, 53 are false positives involving Markdown, ordinary Chinese text, service links, or documented authentication. One alert covers real execution of an unpinned npm package; a separate semantic finding identifies polling without a deadline or attempt limit. No evidence found of prompt injection, credential exfiltration, or reconnaissance in the supplied files; external package and service behavior was not verified.
The workflow continues querying every nonterminal job and permits stopping only at completion, tool failure, or user request. A stalled service can consume unbounded requests and agent execution time.
The stopping conditions explicitly omit a deadline or attempt budget. Waiting between requests reduces frequency but does not bound total resource consumption.
The fenced examples execute npx -y socialdatax-skills@latest, automatically running mutable third-party code with access to the configured API credential. This is a supply-chain execution risk, not Ruby backtick substitution.