fairstack-stock-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill's SKILL.md shows it fetches and acts on B-roll metadata and URLs from third-party, user-contributed sources (Pexels/Pixabay) via the FairStack API endpoints such as GET /api/broll, /api/broll/:id and /api/broll/random, so untrusted fields like name/tags/aiKeywords could influence the agent's selection and subsequent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes a specific API endpoint that performs a monetary charge: POST /api/broll/:id/use "Use a B-roll clip in your project. Deducts $0.002" (also reflected in SDK examples and the 402 INSUFFICIENT_CREDITS error). This is an explicit, service-specific transaction that debits credits/charges for use — i.e., it can trigger a real payment/charge. Therefore it grants direct financial execution capability (for purchases of clips).