adcp-scorecard

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask for and reuse a bearer token and to embed it into per-command environment prefixes (ADCP_AUTH_TOKEN= npx …), which requires the LLM to accept and output the secret verbatim in generated commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime fetching/execution of remote packages and repository-installed skills — e.g. installing/calling the official buyer SDK/skills (https://github.com/adcontextprotocol/adcp/tree/main/skills, https://github.com/adcontextprotocol/adcp) and the @adcp/sdk package (https://www.npmjs.com/package/@adcp/sdk via npx), so remote code would be fetched and executed during pilot runs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly supports running "media-buy" operations and making direct protocol calls that activate buys/spend (it names the official AdCP buyer skills, "adcp-media-buy" for discovery/buy/delivery tests, and direct invocation via "npx @adcp/sdk ..."). It requires inputs like "maximum permitted financial exposure" and describes "spend-affecting operations" with mandatory approval gates, which indicates the skill's primary purpose includes creating financial commitments (ad spend). These are specific, protocol-level mechanisms to execute purchases, not generic automation or generic API callers, so this grants direct financial execution capability.