ClawHub
Back to skill

Security audit

Apple Ads CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Apple Search Ads reporting, but it asks users to globally install an unpinned third-party CLI that will handle Apple Ads credentials.

Review before installing. Use a pinned, verified version of apple-ads-cli in an isolated environment if possible, avoid broad inherited environment variables for tokens, store credentials with owner-only permissions, and use the least-privileged Apple Ads access available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-28
Vulnerability Type: Unsafe third-party package installation
Risk Level: Medium

Vulnerable Code

markdown
If the CLI is not installed, install it:

```bash
npm install -g apple-ads-cli
text

### Technical Analysis

The Skill instructs the agent to install the latest available version of `apple-ads-cli` globally from the npm registry. The dependency is not pinned to a reviewed version and no package integrity hash, publisher verification, provenance requirement, or lifecycle-script restriction is specified.

An npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Global installation also places executable files into a shared command path. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed.

This risk is particularly significant because the installed CLI is subsequently entrusted with an Apple Ads OAuth access token and organization identifier. The Skill permits credentials to be supplied through environment variables, a command-line-selected credentials file, or the automatically detected `~/.config/apple-ads-cli/credentials.json` file. The repository contains only documentation and does not include the CLI implementation, so its claimed read-only behavior, credential handling, network destinations, and filesystem access cannot be independently verified from the audited artifact.

No evidence establishes that the referenced package is currently malicious. The confirmed issue is the unsafe, unpinned global dependency installation procedure and the resulting supply-chain exposure.

### Attack Path

1. An attacker compromises the npm package, its publisher account, source repository, or release process.
2. The attacker publishes a new package version containing a malicious lifecycle script or modified CLI executable.
3. A user or age
...[truncated 1455 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specifically reviewed version instead of installing the latest release:
    bash
    npm install --global --ignore-scripts apple-ads-cli@REVIEWED_VERSION
  2. Verify package provenance, publisher identity, repository ownership, release signatures, and npm integrity metadata before installation.
  3. Record and validate a cryptographic digest for the reviewed package archive in a trusted installation process.
  4. Avoid global installation. Prefer a locked, isolated project environment or a verified standalone artifact so the package cannot replace shared executables.
  5. Disable npm lifecycle scripts with --ignore-scripts unless a reviewed version demonstrably requires them. If scripts are required, audit each script before execution.
  6. Vendor or include the reviewed CLI implementation where practical so its behavior can be audited together with the Skill.
  7. Run the CLI under a restricted account or sandbox with minimal filesystem and network access. Allow outbound traffic only to the required Apple API endpoints.
  8. Use a narrowly scoped Apple Ads credential with the minimum server-side permissions necessary for reporting. Do not reuse credentials across unrelated tools.
  9. Store the credentials file with owner-only permissions, avoid exposing tokens in broadly inherited environments, and never include credentials in command output or logs.
  10. Document the exact verified package version, expected network endpoints, credential-access behavior, and upgrade review procedure.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
## Authentication

The CLI requires an **OAuth2 access token** and an **organization ID**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variables: `APPLE_ADS_ACCESS_TOKEN` + `APPLE_ADS_ORG_ID`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
## Authentication

The CLI requires an **OAuth2 access token** and an **organization ID**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variables: `APPLE_ADS_ACCESS_TOKEN` + `APPLE_ADS_ORG_ID`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md
## Authentication

The CLI requires an **OAuth2 access token** and an **organization ID**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variables: `APPLE_ADS_ACCESS_TOKEN` + `APPLE_ADS_ORG_ID`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
1. `--credentials <path>` flag (per-command)
2. Environment variables: `APPLE_ADS_ACCESS_TOKEN` + `APPLE_ADS_ORG_ID`
3. Auto-detected file: `~/.config/apple-ads-cli/credentials.json`

The credentials JSON file must contain `access_token` and `org_id` fields. The access token is obtained by signing a JWT with your private key (ES256) and exchanging it at Apple's OAuth endpoint. Tokens expire after 1 hour.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest trigger list includes broad phrases such as "Apple Ads," "app eligibility," and especially "search ads," which can plausibly appear in general discussion and may invoke the skill when the user is not specifically asking to use this Apple Search Ads CLI. The description does not provide exclusion conditions or negative examples to narrow activation scope.

Content

No source excerpt is available for this finding.