ai-video-scroll-animation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required browser automation flow explicitly navigates to and snapshots a public third-party site (https://higgsfield.ai/create/video) to detect generation status and download resulting media (references/higgsfield-browser-flow.md and SKILL.md), so it ingests untrusted third‑party content which directly drives decisions and tool actions (polling for "Download", reading video.src, and performing downloads/ffmpeg processing).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's drop-in template loads and executes third-party JS at runtime from https://cdn.jsdelivr.net/npm/gsap@3/dist/gsap.min.js and https://cdn.jsdelivr.net/npm/gsap@3/dist/ScrollTrigger.min.js (required for the scroll/animation behavior), which are external scripts fetched and executed in the user's runtime environment.