google-ads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Google Ads agent skill exposes an outsider-provided query string (GAQL) directly to the LLM-free text input in the search tool, which the required runtime passes to searchGaql() and sends as the JSON body to customers/{customerId}/googleAds:search at lib/googleAdsFetch.ts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is an explicit Google Ads connector that includes write/mutate operations for campaign and budget management (createCampaignBudget, updateCampaignBudget, setCampaignStatus) and notes budgets/bids in micros. It therefore provides API-level ability to modify ad spend budgets — meeting the "Direct Financial Execution" criterion.