build-campaign

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to read an access_token from local settings and then use it in Authorization headers for curl/API requests (substituting it into generated commands), which requires the LLM to handle and output a secret value verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is specifically designed to interact with the Spotify Ads API to create campaigns, ad sets, and ads. It requires and sends budget fields (budget.micro_amount in micro-units) in ad set creation, runs audience estimate calls that include budget, and supports executing those API calls automatically (auto_execute). Because it can create/modify ad sets with explicit budget amounts via the provider API (i.e., manage ad spend allocation), it constitutes direct financial execution authority for ad spend management.