tiktok-influencer-finder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's script (scripts/find_influencers.py -> run_influencer_search) starts an Apify actor and fetches dataset items from Apify (/datasets/{dataset_id}/items), which are public TikTok profile data (user-generated/untrusted) and the SKILL.md + filter_results explicitly instructs the agent to read fit/fitDescription and other profile fields to filter/sort and decide which profiles to return, so third-party content directly influences agent decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill starts a remote Apify actor at runtime (POST to https://api.apify.com/v2/acts/apify~influencer-discovery-agent/runs, or via the GooseWorks proxy at https://api.gooseworks.ai/v1/proxy/apify when GOOSEWORKS_API_KEY is set), which executes remote code and is required for the skill to function, so this is a runtime external dependency that executes remote code.