recoup-lyric-video

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Runtime calls POST $BASE/content/transcribe with user-supplied SONG_URL (public audio URL) and ingests the returned fullLyrics/segments[].text into the LLM flow for lyric timing/spelling, making the transcribed text an outsider source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly calls the runtime endpoint https://api.recoupable.com/api/content/templates (and the template-detail endpoint under https://api.recoupable.com/api/content/templates/{id}) to fetch "full recipe" objects that include prompts/motion/caption styles which are then injected into generation, meaning remote content directly controls the agent's prompts at runtime.