ClawHub
Back to skill

Security audit

Google Ads Campaigns as Code

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Google Ads campaign planning and paused-creation tool with an optional budget guard that can pause campaigns, so users should configure that guard carefully.

Install only if you are comfortable giving the mutating path Google Ads API credentials for the target account. Treat budget-cap-guard.js as a separate opt-in account automation: set HARD_CAP, replace the sheet placeholder, and strongly consider setting NAME_CONTAINS before scheduling it, because the default can pause every enabled campaign in the account when the cap is reached.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The skill description says it creates reviewable JSON specs and paused campaigns, but the bundled behavior also includes an autonomous budget-cap script that can pause enabled campaigns account-wide, write to Google Sheets, and delete alert rows. That mismatch is dangerous because an operator may approve or deploy the skill expecting a narrow, review-only campaign creation tool while it also contains automation with broader operational impact and data-retention side effects.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file introduces active operational behavior outside the stated skill boundary of producing offline, reviewable JSON campaign specs. It can automatically pause campaigns and write to a spreadsheet on an hourly schedule, creating side effects in a live ad account that are not subject to the skill's review-only workflow. In the context of an agent skill, that mismatch is dangerous because users may trust the skill as non-executing while this auxiliary script changes production state.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script contains account-wide automatic budget enforcement that pauses every enabled campaign unless optionally filtered by name. Even if intended as a safety control, this is powerful live-account automation unrelated to a campaign-spec generation skill and can cause broad denial of service for advertising operations, including campaigns not created by this skill. The skill context makes this more dangerous because the declared purpose suggests limited offline artifact generation, not privileged production controls.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The script silently defaults campaign language to English when the spec omits a language, which can cause ads to be created with unintended targeting. In the context of ad-spend automation, insecure defaults are financially meaningful: a user omission can broaden or misdirect delivery without explicit review of the effective language setting.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.