tiktok-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Outsider-authored TikTok webhook POST bodies and headers are read at runtime (e.g., Express uses express.raw then JSON.parse(req.body.toString('utf8')) and logs fields), so attacker-controlled free text from the webhook can enter the agent’s execution context (even if not used for LLM prompting).