ClawHub
Back to skill

Security audit

Microsoft Ads MCP

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Microsoft Ads management integration, but users should treat it carefully because it can control real ad campaigns and uses an external MCP server.

Before installing, inspect the linked MCP server and its Python dependencies, use an isolated environment, protect the mcporter config and Microsoft Ads credentials, and test with paused or low-budget campaigns. Require explicit human review before activating campaigns, changing bids, adding keywords, or creating ads that could spend budget.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill enables creation, activation, and modification of live Microsoft Ads campaigns, but the description does not clearly warn that these actions can immediately spend real advertising budget and alter a production ad account. In an agentic context, missing this warning increases the chance of unintended high-cost actions because users may invoke tools without realizing they are authorizing financially consequential changes.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: microsoft-ads-mcp
description: Create and manage Microsoft Advertising campaigns (Bing Ads / DuckDuckGo Ads) via MCP server - campaigns, ad groups, keywords, ads, and reporting
metadata: {"clawdbot":{"emoji":"📢","requires":{"commands":["mcporter"]},"homepage":"https://github.com/Duartemartins/microsoft-ads-mcp-server"}}
---
Confidence
69% confidence
Finding
Create and manage Microsoft Advertising campaigns (Bing Ads / DuckDuckGo Ads) via MCP server - campaigns, ad groups, keywords, ads, and reporting metadata: {"clawdbot":{"emoji":"📢","requires":{"comman

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.