linkedin-launch-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to WebFetch public URLs (see SKILL.md Step 1c: "Public web — WebFetch the URL only if 1a/1b are empty") and references/brand-identity.md also shows "WebFetch " to extract homepage HTML/CSS/copy, and that fetched, untrusted webpage content is parsed to build the brand-kit and drive the script/format decisions, so third-party page content can materially influence actions and outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The composition template includes a runtime-loaded script tag for GSAP at https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js which will be fetched and executed during the HyperFrames render step (npx hyperframes render), so this external URL is a required runtime dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit LinkedIn Ads tool calls (linkedin_ads__tool_create_campaign_group, linkedin_ads__tool_create_campaign, linkedin_ads__tool_create_creative and get_audience_counts) and even mentions budget amounts ("100.00" = $100). These are specific ad-spend management APIs (creating campaigns/campaign groups and supplying budget values), which fall under "Managing Ad Spend Budgets" in the core rule. Even though campaigns are created PAUSED by default, the skill programmatically creates campaign entities and accepts budget parameters — this is direct financial execution capability.