media-proxy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime path only ingests outsider-authored free text indirectly via user-supplied prompt/payload fields (e.g., payload.get("prompt") and logging prompt), but it is not passively consuming outsider-posted feeds/queues (it only submits/ polls FAL jobs and writes diagnostic logs).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly routes paid media API calls through internal proxies with ?token=&agent_id= that "bills the Ads agent" and notes "A FAL submit BILLS immediately". It is specifically designed to perform paid submissions that cause billing (i.e., execute financial charges for renders), so it provides direct financial execution capability.