ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The ads skill’s runtime workflow ingests only the user’s single free-text prompt to generate a paid-acquisition plan, and it does not read any outsider-authored external feed/inbox/ticket/comment/issue text or require searching/fetching arbitrary content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly a paid-acquisition operator whose primary purpose is to run ad spend ("You run money through Google and Meta to buy customers") and to execute the Google/Meta buy down to asset groups, bids, and budgets. It prescribes budget and scaling rules (e.g., floors, scale ≤20%/week) and references the Google Ads API for scripting — i.e., it is specifically designed to manage and change ad budgets/spend, which constitutes direct financial execution of ad spend.