apple-ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required runtime workflow reads Apple Ads account data via scripts/fetch-ads.ts / scripts/inspect-account.ts calling the authenticated Apple Ads Platform API (https://api.ads.apple.com/v1) and does not ingest outsider-authored free text without the user first selecting specific account entities/reports (e.g., --report=..., --campaign=..., --terms=...).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a literal private key found in the test code. Rationale:
• scripts/test/apply-change.test.ts lines 86–92 define TEST_PRIVATE_KEY as a full PEM private key (-----BEGIN PRIVATE KEY----- … base64 … -----END PRIVATE KEY-----). This is a high-entropy, literal private key value (usable credential) and meets the definition of a secret (private key).
• The other matches (e.g., APPLE_ADS_PRIVATE_KEY examples in .env.example and the example string in api-client.ts) are documentation placeholders that contain "..." or escaped \n sequences and are clearly example/template values, so I ignored them per the “Documentation Placeholders” rule.

Therefore there is one real secret present (the test private key).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes a write path (scripts/apply-change.ts) that performs billing-impacting operations: changing campaign budgets, campaign-status, adgroup/keyword bids and statuses, and creating campaigns with --budget. It includes examples of executing those changes with --apply (recorded in ledger.md). This is a specific ad-spend management interface (directly updates budgets and launches/enables campaigns), so it grants Direct Financial Execution authority.