onboarding

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to ask users for API secrets (e.g., App Secret), to construct token-exchange URLs using those secrets, and to write those credentials verbatim into a .env file via the Edit tool, which requires the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md onboarding explicitly instructs visiting and running OAuth flows and API/test scripts against public third-party sites (LinkedIn, Meta/Facebook, Google Ads) and to ingest tokens, account IDs, and API responses, so the agent will consume untrusted web content from those sites that could influence subsequent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provisions API credentials and tokens for LinkedIn Ads, Meta Marketing API, and Google Ads API, and it advertises capabilities to "create, manage, and scale your ad campaigns" and exposes follow-up commands (/linkedin-ads, /meta-ads, /google-ads) to manage campaigns. Those platform APIs include endpoints to modify ad spend and budgets (i.e., directly control money spent on advertising). Because this onboarding is specifically designed to enable ad-account API access and subsequent campaign/budget management, it constitutes direct financial execution authority.