google-ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow uses ClawLink to access Google Ads via the user’s OAuth connection, and the LLM ingests Google Ads data returned by Google’s APIs (outsider-authored content from a third-party service) as readable text during actions like describe/run.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx @useclawlink/cli (https://www.npmjs.com/package/@useclawlink/cli) at runtime, which fetches and executes remote npm package code and is required for the agent to perform Google Ads actions, so this is a runtime-executed external dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides write actions for Google Ads, including "googleads_mutate_campaigns" (create, update, or remove campaigns) and related mutate operations for ad groups/criteria. Those mutation endpoints can change campaign budgets, bids, and otherwise control ad spend. The CLI also exposes a "run" command to execute those actions (not just read-only queries). Because this is a specific integration for managing Google Ads and can directly modify budgets/ad configurations, it constitutes direct financial execution authority.