tiktok-video-ad

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires returning full asset URLs including all query parameters (and references an API key in the config and an invite code in setup), which forces the agent to output backend tokens/credentials verbatim and thus poses a high exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill’s runtime scripts require and call the Pexo API at PEXO_BASE_URL (https://pexo.ai); the service’s JSON responses (nextAction, recentMessages, preview/final asset URLs) are fetched during runtime and directly drive the agent’s prompts, actions, and control flow, making this an external dependency that controls the agent.