AB-Directolog-Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.2

Overview

This skill matches its Yandex.Direct advertising purpose, but it gives an agent live ad-account authority while retaining or printing sensitive tokens without enough safeguards.

Install only after tightening operational controls: use a dedicated revocable Yandex app/token, keep secrets out of agent memory and logs, remove token printing, redact diagnostics, and require explicit approval or dry-run review before any campaign, budget, bid, or ad changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README advertises capabilities to create and edit advertising campaigns, ads, bids, and strategies without warning that these operations can modify live production campaigns and directly affect ad spend. In an agent-integrated context, this omission increases the risk of unsafe use, accidental budget changes, and unintended business impact by users who may assume the actions are informational rather than state-changing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The token acquisition section explains how to obtain access tokens and use client secrets but does not clearly state that these are sensitive credentials that must never be shared, logged, pasted into chats, or committed to repositories. Because the skill is intended for agent use, users may expose long-lived API credentials to the agent runtime or prompt history, enabling unauthorized access to Yandex.Direct accounts and campaign manipulation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to place OAuth client secrets and access/refresh tokens in a local .env file, but provides no guidance on file permissions, secret managers, exclusion from version control, or redaction in logs. Because these credentials allow authenticated access to Yandex.Direct accounts, accidental disclosure via commits, backups, debugging output, or shared agent environments could enable unauthorized campaign access and modification.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example persistent memory file includes account identifiers and refresh-token information in agent memory, normalizing retention of highly sensitive credentials alongside campaign context. Persistent agent memory is often broadly accessible to tools, logs, backups, or other skills, so retaining refresh-token data materially increases the chance of account takeover or unauthorized ad-spend changes if the memory store is exposed.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The optimization scenario describes automatically sending batch bid changes to live advertising campaigns without an explicit confirmation step, dry-run mode, or warning that production settings will be modified. In an agent context, this can lead to unintended spend changes, degraded campaign performance, or unauthorized account actions if the agent is triggered incorrectly or prompted maliciously.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Automatically refreshing OAuth tokens and retrying requests means the agent can perform additional credential use and outbound network activity without user awareness at the time of execution. In a tool-integrated agent, this increases the risk of silent continued access to a live ad account after token expiry and can mask unexpected or unauthorized operations.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The description defines a powerful advertising-management role in very broad terms, covering campaign control, analytics, and optimization without explicit boundaries, approval requirements, or trigger conditions. In an agent setting, this can lead to overbroad authority and unsafe actions such as modifying campaigns or making spend-affecting decisions based on ambiguous user input.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends sensitive credentials and a refresh token to an external endpoint and then prints the full token response and extracted access token to stdout with no warning, masking, or confirmation. In practice this can expose secrets in terminal history, CI logs, shell transcripts, or shared consoles, making credential compromise more likely even though the endpoint itself is the expected OAuth server.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The advice to log all API requests creates a direct retention path for Authorization headers, account identifiers, request bodies, campaign data, and possibly tokens if implemented naïvely. Such logs are commonly shipped to centralized systems and retained for long periods, making them a high-value source of credential and business-data leakage.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The memory example encourages storing client identifiers and refresh-token information in persistent agent memory, which is a sensitive-data retention issue independent of the .env guidance. Persistent memory broadens exposure across sessions, components, and operators, and refresh tokens are especially dangerous because they can be used to mint new access tokens repeatedly.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.