clone-video-ad

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path: step 0/“spy-competitor-ads” may select an outsider-authored competitor video ad source, and step 2 then transcribes that source’s dialogue text via POST /v1/transcripts, so attacker-authored content can reach the LLM through the transcription response.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). references/solo-install.md (used when shared/ is missing) tells users to fetch prompt/docs and scripts at runtime from https://raw.githubusercontent.com/novoads/claude-code-ads/main/ and to git clone https://github.com/novoads/claude-code-ads.git, which would supply prompt templates and scripts that directly control agent prompts or could provide executable code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with the Novoads billing surface: it performs live POST /v1/estimates calls to obtain credit pricing, requires a REST API key, and performs POST /v1/videos submissions that are billed. The doc references returned fields like credits, balance, sufficient, creditsCharged, shortBy and topUpUrl, handles 402 insufficient_credits, and instructs summing creditsCharged and gating generation on a user-approved estimate. Those are explicit, specific billable API calls that trigger charges (not generic HTTP or browser automation), so the skill grants direct financial execution capability for purchasing/rendering billable items.