ad-creative

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two referenced GitHub repos (gooseworks-ai and Bomx) are third‑party, non-official sources tied to installable agent pipelines (including an npx install command in the docs), which are a common vector for distributing untrusted code — treat them as suspicious until verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow ingests outsider-authored free text when the user provides “performance data” (Mode 2) and explicitly supports pasting CSV/API output that the agent then analyzes and uses to generate new ad copy.