Server-Side Conversion Tracking

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.3

Overview

The skill is coherent, but it should be reviewed carefully because it directs users to run an external Docker deployment that will handle ad credentials and customer conversion data without immutable pinning or enough deployment guardrails.

Review before installing or following the deployment steps. Pin the external repository to a specific reviewed commit, pin container images by digest, verify signatures or checksums where available, run it in an isolated environment, set production secrets yourself, and only send conversion data when you have the required consent and privacy disclosures in place.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:99

Finding

Unpinned Remote Repository and Container Images Are Executed Through Docker Compose

Content

View full analysis

(Apache-2.0), check out a release tag, and read its `docker-compose.yml` - it declares the images and ports that will run. From that checkout: ```bash docker compose up # open http://localhost:4321, complete /setup, then Settings → Ad platforms ``` ``` ### Technical Analysis The Skill directs users to retrieve an external Git repository and execute the services declared by its Docker Compose configuration. It does not identify an immutable reviewed Git commit, require verification of a signed release, or pin container images to cryptographic digests. A release tag does not provide the same immutability guarantee as a commit hash, and image tags referenced by a Compose file may resolve to different image contents over time. Consequently, the effective executable payload can change after this Skill has been reviewed. Merely reading `docker-compose.yml` does not authenticate the downloaded images or reveal malicious behavior embedded inside an image. This deployment is especially sensitive because the described service processes advertising-platform access tokens, click identifiers, IP addresses, user agents, customer identifiers, and order information. ### Attack Path 1. An attacker compromises the referenced GitHub repo ...[truncated 1712 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

| Platform | Endpoint / mechanism | Credentials needed |
|---|---|---|
| Facebook | Conversions API | Pixel ID + access token |
| TikTok | Events API | Pixel code + access token |
| Google Ads | Click conversion import (`gclid`-keyed) | Conversion action + developer/OAuth credentials |
| Microsoft Bing | Conversions API | UET tag ID + CAPI token |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

| Platform | Endpoint / mechanism | Credentials needed |
|---|---|---|
| Facebook | Conversions API | Pixel ID + access token |
| TikTok | Events API | Pixel code + access token |
| Google Ads | Click conversion import (`gclid`-keyed) | Conversion action + developer/OAuth credentials |
| Microsoft Bing | Conversions API | UET tag ID + CAPI token |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs collection and transmission of privacy-sensitive data including client IP, user agent, click IDs, and hashed identifiers to third-party ad platforms. While this is common for server-side conversion tracking, the guidance does not foreground consent, disclosure, minimization, retention, or jurisdictional compliance at the point where the data flow is implemented, which creates a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The implementation section walks the operator through deploying a live integration and configuring ad-platform credentials and queued postbacks, but does not prominently repeat that this causes ongoing external data transmission. That omission can lead users to operationalize third-party sharing in production without fully considering consent controls, notice obligations, and environment hardening.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.