marketing-carousel-growth-engine

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow requires scraping arbitrary user-provided or target website URLs using Playwright, which allows untrusted external web content to be ingested by the agent during the research phase.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). An operational dependency on an external API (api.upload-post.com) is evidenced for publishing and analytics, but it lacks strong first-party enterprise provenance and constitutes a common/reputable unofficial dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates an automated social media publishing workflow (publishing carousels to TikTok and Instagram via the Upload-Post API). This constitutes an indirect financial operation (publishing content/media for public reach and distribution). No direct funds transfer, purchase, or billing/payment instruction is performed.