google-ads

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs commands like cat ~/.google-ads.yaml and asks about/depends on Google Ads API credentials/OAuth tokens, which would require reading and potentially outputting secret keys or tokens verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In Browser Automation Mode, the runtime uses a browser tool to navigate to ads.google.com and then “snapshot”/parse the campaigns/keywords tables; those page contents are free-form text originating from Google Ads UI (an external web source) and are ingested into the agent’s LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill provides explicit, actionable controls over ad spend: both Browser Mode and API Mode include operations to pause campaigns/keywords (Browser: "Click 'Pause' ... Confirm action"; API: code that builds AdGroupCriterionOperation and sets status = PAUSED and calls mutate_ad_group_criteria). These are authoritative actions that directly change campaign behavior and thus control spending. Managing and mutating Google Ads campaign/keyword status is a specific ad-spend execution capability (not merely viewing), so it meets the "direct financial execution" criterion for ad spend management.