google-ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the GAQL search tool, the outsider-supplied query string is passed directly into the Google Ads API request body (searchGaql → googleAdsRequest to POST /customers/{customerId}/googleAds:search), so free text can be ingested without pre-selecting any specific item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes tools to manage ad spend: the description and use-cases state it can "manage campaign status and budgets" and "create or adjust a daily budget", and the scripts list includes createCampaignBudget and updateCampaignBudget (writes through mutate endpoints). These are specific APIs to change advertising budgets (directly affecting financial spend), which qualifies as Direct Financial Execution authority.