ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required /ads audit//ads competitor workflow, the skill explicitly treats “supplied pages, exports, screenshots, API responses, and competitor content” as untrusted context and loads it for analysis, meaning outsider-authored free text can be ingested via the user-provided inputs the runtime consumes.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to operate paid advertising accounts across major platforms and includes commands to "draft or execute" campaign launches and optimizations (with --apply). It also routes budget-related commands and requires a mutation gate for writes, meaning it can perform account mutations (including budget/ campaign changes) via platform adapters when approvals/ceilings exist. Managing ad spend budgets and executing campaign changes via platform APIs is a direct financial-execution capability under the ad-spend category.