picsart-video-rules

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads user-provided files and briefs in the session as part of the brief-handling instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The instruction in HOST.md line 48 instructs the agent to download and execute an external URL using curl in a bash tool (curl -sL -o <file> "<url>"), constituting an unverified operational download dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a direct financial interaction (charging credits for video/image generation tools via picsart_generate, picsart_preflight, and credit balance checks). However, it relies entirely on human-in-the-loop operational gating—requiring the agent to quote the cost, check the balance, and obtain an explicit "yes" confirmation from the user before executing any paid call (SKILL.md:163-173). Because qualifying independent access control enforced by the service or execution layer is not documented for the payment route itself (relying instead on agent-followed confirmation flags and user consent), it is classified as a direct operation without established qualifying control.