riffkit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires passing a live vee_session account token on API requests (a secret tied to billing), which forces the agent to handle and embed a secret in outgoing requests and so risks verbatim exposure if the LLM emits or logs those requests.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes submitting a user-provided TikTok URL or uploaded video via POST /api/riffs and then polling GET /api/tasks/batch/{batch_id}/GET /api/assets, so outsider-authored free text content from the user’s chosen source is ingested by the runtime workflow without selecting a specific trusted item first.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes an authenticated API call that initiates a billed transaction: the user must provide a vee_session token and the workflow requires calling POST /api/riffs to start a paid render (billed by the second). The docs warn about HTTP 402/top-up and emphasize explicit confirmation before submitting. Because the skill can directly trigger a charge on the user's account (a billable mutation), it grants direct financial execution authority.