google-ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via user-provided prompts and uses them to decide GAQL reads/optimizations, with no indication of filtering to prevent prompt-injection influence on what the agent fetches or how it interprets data.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent to use MCP server playbooks fetched at runtime (notfair://playbooks/audit-account and notfair://playbooks/explain-regression), which are external playbook URLs that can supply starting queries/instructions and thus directly influence agent prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes write/mutation tools that can change ad budgets and bidding (lines showing "update ... budgets" and bulk write ops like "bulkUpdateBids"), and it requires confirming "dollar exposure" before firing changes. These are specific APIs to modify ad spend/budgets (direct financial execution authority for ad spend), not generic tooling.