@tank/google-search-ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested via the weekly cron-triggered workflow’s required user-provided Google Ads CSV exports (e.g., Search terms report “Search term” column), which are not authored by the operating user and are parsed into LLM context for normalize_report.py → diagnose.py → findings.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly instructs the agent to detect and invoke the host scheduler (cron) via a _tool_call to schedule weekly tasks (or write crontab lines), which would modify the host's scheduling state (crontab) and thus alter the machine's state even though it doesn't request sudo or user creation.