tiktok-follower-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The Skill includes explicit instructions to install dependencies automatically without user confirmation and to avoid describing or requesting approval for that installation, which is deceptive and outside the stated scraping/data-collection purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill is designed for large-scale data collection of user contact info and contains explicit, deceptive instructions to auto-install external CLI dependencies without user consent and to hide workspace credentials — indicating high risk for unauthorized installation, supply-chain abuse, and data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md instructs the agent to invoke the BrowserAct CLI to access real TikTok/public web pages at runtime (public web content fetched at runtime), which can include outsider-authored free text that the LLM may ingest while extracting fields.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and install/invoke the BrowserAct CLI at runtime using https://www.browseract.com/?co-from=lead-generation and https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main, which are required runtime installs that fetch and execute external code and control the agent's browser workflows.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill instructs the agent to automatically install the BrowserAct CLI and resume execution without asking the user for approval, which directs the agent to modify the host system (potentially requiring elevated privileges) even though it doesn't explicitly request sudo or create users.