novoads-claymation-storyboard-ad

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs uploading bytes with "headers VERBATIM" (and directs adding an MCP connector), which forces inclusion of exact signed URLs/headers or auth tokens in requests/output and thus requires handling secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In entry B (“From a found video”), the runtime calls analyze_ad assetId, question which “reads the first 20 seconds of a video” from upload_asset, so outsider-authored content submitted as the video reference is directly ingested as free text (via extracted on-screen text/summary) without the agent needing a prior specific item selection.