asa-admaxxing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs including API credentials (rc_key and app_id) in request blocks and tells the agent to "pass ASA credentials" (or rc_key + rc_project), which requires the LLM to emit secret values verbatim in commands/requests.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes write/update operations for ad spend: it lists specific ASA management APIs/functions (e.g., asa_update_targeting_keywords, asa_update_campaign, asa_create_campaign_negative_keywords, asa_create_targeting_keywords) and recommends/apply budget changes (e.g., recommend 20% budget increase, "BUDGET +20%"). These are specific ad-spend management APIs (directly updating campaigns/budgets), which qualifies as Direct Financial Execution.