asa-weekly-optimization

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes a parameter example "rc_key: "<sk_xxx>"" (sk_... style) that implies the agent must insert or forward an API secret in tool calls, which would require handling/outputting a secret value verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes APIs and commands that change ad spend: it defines bid-adjustment rules and budget actions (e.g., "Increase daily budget 20%"), and lists specific operations such as asa_update_targeting_keywords ("# bid and status changes per keyword ID"), asa_create_targeting_keywords, and asa_bid_recommendations. Those are explicit interfaces to modify bids/pauses/budgets on Apple Search Ads — i.e., direct ad-spend/financial execution.