goose-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). This skill’s required runtime workflow pulls outsider-authored free text by fetching template/recipe content from the ad_sample DB and S3 (e.g., recipe.instructions.inline prose or recipe.instructions.doc_url markdown, plus capability scripts), which the agent must execute/read and thus may include indirect prompt-injection payloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs at runtime to pull and run the prebuilt Docker image ghcr.io/gooseworks-ai/goose-video-render to provide/execute the render toolchain (ffmpeg, ffprobe, Playwright Chromium), which fetches and runs remote code during execution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly calls billable APIs and actions that debit the Ads agent's credits: it references the get_ad_credits MCP tool, documents that media-proxy calls are "the REAL spend" billed to the agent, notes that submit_render debits an ad credit when opening a render row, and the proxy code (fal_generate) and rules require passing project_id/agent_id so spend is attributed. These are explicit, actionable operations that will cause charges/credit debits on the agent's account (i.e., execute financial spend), so this grants direct financial execution authority.