krea-marketing

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains an explicit npx package installation command instructing the agent to fetch external code at runtime from heygen-com/hyperframes, which constitutes an unverifiable runtime external dependency from an unofficial GitHub-owned repository.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill is a creative AI agent for Krea.ai (SKILL.md:10) that generates marketing visuals, ads, storyboards, and content. It optionally interfaces with Meta Ads MCP for performance analysis, account reads, and campaign drafting/activation (SKILL.md:12, 75, SKILL.md:21, 33), where writes are paused by default and live launch/budget changes require explicit approval (SKILL.md:33). This constitutes an indirect financial/campaign operational capability (ad campaign management/activation). As an indirect operation, it is evaluated under the indirect financial scope and does not require direct payment control evaluation.