tiktok-spark-ads

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs copying Spark Ads authorization codes and shows API payloads (tiktok_ads_create_ad / spark_ads_auth_code) where the agent would need to include those codes verbatim in requests or outputs, which requires the LLM to handle secret values directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit, named ad-management API calls (tiktok_ads_create_ad, tiktok_ads_list_ads, tiktok_ads_upload_video_from_url, tiktok_ads_update_campaign_status) that create ads and enable campaigns. Those operations directly initiate or control paid ad delivery (i.e., cause spend on an ad account), which is a specific financial-execution capability rather than a generic tool.