AdsTurbo 广告视频复刻 · AdsTurbo Ad Video Clone

• Outcome: Review
• Latest audit: Oct 14, 2026 · 3:32 AM UTC
• Version: 1.2.3

Overview

This skill mostly does what it says, but it can spend AdsTurbo credits through a direct submit command without a built-in confirmation check.

Install only if you intend to use AdsTurbo for ad analysis and cloning. Keep the API key in an environment variable, do not upload private or unauthorized media, and require an explicit user confirmation after reviewing the quoted credit cost before running any draft-submit or generation command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ad_clone.py:193

Finding

Paid generation endpoint lacks an enforced user-confirmation gate

Content

View full analysis

Vulnerability Details

File Location: scripts/ad_clone.py, lines 193–199
Vulnerability Type: Unconfirmed credit-charging operation
Risk Level: Medium

Complete Code Snippet

python

def cmd_draft_submit(client, args) -> dict:
    receipt = client.post(DRAFT_SUBMIT, {
        "clone_id": args.clone_id,
        "edits": build_edits(args) or None,
        "video": build_video(args) or None,
        "callback_id": args.callback_id,
        "idempotency_key": args.idempotency_key,
    })

Technical Analysis

The Skill documentation states that draft-submit charges credits and must only be invoked after the user has reviewed the quote returned by draft-preview and explicitly confirmed submission. However, the executable submission path does not enforce that authorization requirement.

Calling draft-submit immediately sends the supplied clone ID, edits, and generation options to the credit-charging /openapi/v2beta/adclone/submit endpoint. There is no required confirmation flag, expected-price check, preview receipt, or server-issued authorization token proving that the user approved the exact quoted operation.

The confirmation requirement therefore exists only as an Agent-facing instruction. A mistaken Agent invocation or an untrusted workflow instruction that causes the Agent to select draft-submit can bypass the documented preview-and-confirm sequence.

Attack Path

1. A draft is created, producing a valid clone_id.
2. An Agent workflow, including one influenced by untrusted task content, invokes draft-submit directly rather than obtaining and presenting a draft-preview quote.
3. The CLI accepts the clone ID and generation parameters without requiring evidence of user approval.
4. cmd_draft_submit immediately sends a POST request to /openapi/v2beta/adclone/submit.
5. The remote service charges credits and starts generation before the user has confirmed the price and exact generation settings.

This path require ...[truncated 581 chars]

Remediation

View remediation

Remediation Suggestions

• Require an explicit confirmation argument such as --confirm-charge before permitting draft-submit.
• Require the caller to supply the expected quoted price and reject submission if it differs from the current server-side quote.
• Prefer a server-issued, short-lived preview token that cryptographically binds the approval to:
  • the clone_id;
  • the exact edits;
  • video duration, resolution, aspect ratio, and quantity;
  • the quoted credit cost;
  • an expiration time.
• Make the submission endpoint reject requests without a valid preview token.
• Display the final price and settings immediately before submission and require an affirmative user response in interactive use.
• Preserve idempotency protection so retries cannot create duplicate charges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance uses very broad phrases like 'clone this video,' 'make one like this,' and 'analyze this ad,' which can match many ordinary multimedia requests without enough narrowing conditions. That can cause the agent to invoke this external API-backed cloning workflow unintentionally, potentially sending user-provided media or URLs to a third-party service and steering the agent into a more invasive or billable path than the user intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Chinese trigger phrases are similarly broad, including common expressions for imitation and analysis that could overlap with routine requests for video understanding or creation. In a multilingual agent, this increases accidental invocation risk across a wider user population and may expose content to third-party processing or trigger unnecessary paid actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to upload and analyze public video URLs and reference images, including swapping in their own person or product, but provides no warning about privacy, consent, or content rights. This can lead users to process copyrighted or personal media without authorization, creating legal and privacy exposure and normalizing risky handling of third-party content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The handlers upload a user-supplied local file path to remote storage endpoints via client.upload, which is a network operation transmitting local data. While the module docstring explains that it returns a public URL, the code provides no confirmation prompt, print/log disclosure, or explicit warning that the file contents will be uploaded to a remote service and made publicly accessible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example workflow specifically says to translate the cloned output to English for overseas placement, which steers output toward a specific language. Because the description does not present this as an optional user choice or offer alternatives, it may violate language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document duplicates the instructions in Chinese after the English section, which implies a fixed bilingual presentation rather than letting users opt into their preferred language. The stated policy only permits locale constraints when choice or clear justification is provided, and this file includes neither.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code posts user-provided video URLs and related analysis parameters to remote API endpoints, which is a data-transmitting network operation. While the module docstring describes functionality, it does not explicitly disclose that supplied URLs and edits are sent to an external service for processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The draft-create flow transmits the reference video URL, clipping parameters, and language selection to a remote endpoint. Although this is part of the feature, there is no clear warning in this file that user content references are sent off-box for processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The help string says 'default en', which indicates the skill defaults output language to English if the user does not choose otherwise. This can violate language/locale choice expectations because the tool imposes a specific language by default rather than explicitly prompting or offering opt-in.

Content

No source excerpt is available for this finding.