ucoz-ad-campaign-landing-skill

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I looked for high-entropy literal values that could be actual credentials.

Flagged:

• GOOGLE_ADS_DEVELOPER_TOKEN value "xsLwgnr1fHf1slJgfx9T3w" (in GOOGLE_ADS.md) — appears as a full, non-truncated token-like string used as an API credential header. It is high-entropy and could be used to access the Google Ads API, so I treat it as a secret.

Ignored / not flagged (with reasons):

• YANDEX_DIRECT_CLIENT_ID = 05c89462fef4400eb3493c4f67d9ceea — client IDs are public identifiers (not secrets) and do not by themselves grant access; treated as non-sensitive.
• YANDEX_SEARCH_API_KEY=AQVN... , YANDEX_DIRECT_TOKEN=AQAAAA... , GOOGLE_ADS_CLIENT_SECRET=GOCSPX-... , GOOGLE_ADS_REFRESH_TOKEN=1//0g... and similar values with "..." truncation — these are truncated/redacted examples, not literal full credentials, so ignored per rules on redacted/truncated values.
• GOOGLE_ADS_CLIENT_ID=123456789-xxxx.apps.googleusercontent.com and other clearly placeholder patterns (e.g., "....apps.googleusercontent.com", "0000000000") — documentation placeholders; ignored.
• Numeric IDs like GOOGLE_ADS_CUSTOMER_ID=6097804519 — account identifiers (non-secret) and treated as non-sensitive.

Summary: one high-entropy API credential-like string was found (Google developer token example) and should be treated as a secret; other entries are placeholders, truncated examples, or non-sensitive identifiers and were ignored.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with Yandex Direct and Google Ads APIs and is designed to construct and send real API payloads (via curl) to create/update campaigns and fetch account ads. It includes production hosts, OAuth/token instructions, and a full "push to Yandex Direct/Google Ads" flow (with campaigns created as SUSPENDED/PAUSED but still created in the live account). That constitutes explicit capability to perform account-level ad operations that can control ad spend (create/modify campaigns and related resources), which meets the "Managing Ad Spend Budgets / execute ad account changes" criterion for direct financial execution authority — even though the skill requires user confirmation before pushing. Therefore it grants direct financial execution capability.