zernio-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes curl examples that embed an API key header (Authorization: Bearer YOUR_API_KEY), which instructs inserting API keys directly into commands and could require the LLM to handle or output secrets verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports "run paid ads on 7 ad networks" and documents an ads surface (rules/ads.md) that includes "List, boost, create, analytics, audiences, conversions" and "ads connections" (OAuth to ad accounts). Creating/boosting ads against Meta/Google/TikTok/LinkedIn/etc. is a specific capability to initiate and manage paid campaigns and therefore to commit ad spend (i.e., change ad budgets/launch spend). This is a targeted financial-execution capability (ad spend execution), not a generic tool, so it meets the "Direct Financial Execution" criterion.