yandex-performance-ops

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflows and required scripts (e.g., /scripts/wordstat_collect_wave.js, /scripts/yandex_search_batch.py, firecrawl_scrape.py and the Competitor Research workflow referencing Google Ads Transparency / Meta Ad Library / landing page captures) explicitly collect and ingest public third-party webpages, social/ad library data and SERP/page captures that agents are required to read and that directly drive decisions (negatives, applies, moderation), so it exposes the agent to untrusted external content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to operate on Yandex.Direct accounts with live apply scripts and API-driven actions. It includes many "apply" scripts (e.g., scripts/apply_tasks.py, scripts/apply_no_moderation_pack.py, scripts/apply_ad_replacement_pack.py, scripts/deploy_search_campaigns.py, scripts/update_callouts_set.py, scripts/retire_ads.py, scripts/apply_shared_negative_set.py, scripts/apply_time_targeting_schedule.py, scripts/send_to_moderation.py) and prescribes live operations such as campaigns.resume, ads.moderate, ads.update, adgroup/campaign adds/updates. The documentation specifically references changing bidding strategies, moving DailyBudget to weekly budget layers, setting BidCeiling/max CPC, PriorityGoals, and other budget/bid parameters — i.e., it is explicitly designed to change ad spend/budgeting via API rather than just read-only analysis. Under the defined decision logic (flag when a tool's primary/explicit definition is to move money), this skill grants direct financial execution authority for ad spend management.