tiktok-api

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the required workflow reads outsider-authored TikTok content via user-controlled search/lookup inputs to GET https://tiktok.fetcher.sh/api/post/search (including keyword, which can be influenced to retrieve attacker-chosen posts) and then ingests returned post/comment text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill exposes and recommends calling runtime machine-readable endpoints that can configure an agent (MCP and schema/LLM files) — e.g. https://tiktok.fetcher.sh/mcp, https://tiktok.fetcher.sh/openapi.json, https://tiktok.fetcher.sh/llms.txt, and https://tiktok.fetcher.sh/skill.md — which an MCP-connected agent would fetch at runtime to discover tools and instruction/schema that directly control agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly describes payment mechanisms: prepaid credit top-ups (POST /api/credits/topup / topup_credits) and an x402 pay-per-call flow that uses USDC on blockchains and a signing helper (@x402/fetch) — i.e., crypto payment/signing and credit top-up APIs. Those are specific financial execution capabilities (moving value), not just generic HTTP calls, so this qualifies as direct financial execution authority.