tiktok-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow monitors and consumes public social media feeds, posts, comments, and search results from TikTok via Crawlora, which allows outsiders to submit arbitrary text into the consumed data stream.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill makes runtime API calls to crawlora.net, which is an external commercial third-party service provider acting as a transporter/API gateway rather than an official publisher of the underlying third-party social media platform data.