21-ads-audit-global

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to read ad account data, metrics tables, dashboard links, and search term reports provided by the user, which can contain outsider-authored text or prompt injections when processing third-party data exports or shared links.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill audits advertising account configurations across Meta, Google, and TikTok. It mentions read and write capabilities via Meta's Ads MCP, but explicitly mandates that any live change must go through draft-first change proposals awaiting explicit human approval ("No direct writes via MCP until a named approver approves that exact block"). It does not independently perform direct financial transfers, charges, or purchases. The operational scope is indirect/advisory configuration review with human-in-the-loop controls.