competitor-ad-scrape

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path: the skill POSTs to the Apify actor to scrape Meta ad library content, then reads that scraped “body text” and video transcripts (and classifies them / inserts into Airtable), so outsider-authored ad copy/transcripts are ingested via the Apify dataset items.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes Apify actor endpoints at runtime (POST to https://api.apify.com/v2/acts/curious_coder~facebook-ads-library-scraper/runs and polling GETs to https://api.apify.com/v2/actor-runs/{runId} and https://api.apify.com/v2/datasets/{datasetId}/items), which executes third-party actor code remotely and is relied on by the pipeline.