Adwords

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:04 AM UTC
• Version: 2.0.0

Overview

This is a mostly ordinary marketing copywriting skill, but one bundled command silently stores user-provided text in a local history file.

Review before installing if you may paste confidential marketing plans, customer details, or unpublished campaign text. The main copywriting templates look local and benign, but avoid using scripts/script.sh with sensitive input unless you are comfortable with local history logging or can control ADWORDS_DIR permissions and delete the log afterward.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:7

Finding

Plaintext Persistence of User-Supplied Content with Insufficient Access Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:7-81
Vulnerability Type: Plaintext sensitive-data storage and log injection
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${ADWORDS_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/adwords}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

cmd_draft() {
    echo "  Draft: $1
      Target: ${2:-800} words"
    _log "draft" "${1:-}"
}

cmd_headline() {
    echo "  1. How to $1
      2. $1: Complete Guide
      3. Why $1 Matters"
    _log "headline" "${1:-}"
}

cmd_outline() {
    echo "  1. Intro | 2. Problem | 3. Solution | 4. Examples | 5. CTA"
    _log "outline" "${1:-}"
}

cmd_seo() {
    echo "  Keywords: $1 | Title tag | Meta desc | H1-H3 | Internal links"
    _log "seo" "${1:-}"
}

cmd_schedule() {
    echo "  Mon: Research | Tue: Write | Wed: Edit | Thu: Publish | Fri: Promote"
    _log "schedule" "${1:-}"
}

cmd_hooks() {
    echo "  Question | Statistic | Story | Bold claim | Controversy"
    _log "hooks" "${1:-}"
}

cmd_cta() {
    echo "  Subscribe | Share | Comment | Try it | Learn more"
    _log "cta" "${1:-}"
}

cmd_repurpose() {
    echo "  Blog -> Thread -> Video -> Carousel -> Newsletter"
    _log "repurpose" "${1:-}"
}

cmd_metrics() {
    echo "  Views | Clicks | Shares | Time on page | Conversions"
    _log "metrics" "${1:-}"
}

cmd_ideas() {
    echo "  How-to | Listicle | Case study | Interview | Comparison"
    _log "ideas" "${1:-}"
}

Technical Analysis

The script records the first user-supplied argument from every content command in the persistent file $DATA_DIR/history.log. This behavior is enabled by default and is not disclosed in the documented invocation workflow.

Neither the data directory nor the history file is created with explicit restrictive permissions. T ...[truncated 2396 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable history logging by default and require an explicit opt-in configuration option.

2. Do not store raw user arguments. If operational telemetry is required, record only non-sensitive command names or irreversible, appropriately keyed identifiers.

3. Create the data directory and log with restrictive permissions:

   bash

   umask 077
   install -d -m 700 -- "$DATA_DIR"
   touch "$DATA_DIR/history.log"
   chmod 600 "$DATA_DIR/history.log"
   

4. Validate that ADWORDS_DIR refers to an expected, user-owned directory and reject unsafe destinations where appropriate.

5. Remove carriage returns and newline characters before writing any user-controlled value to a line-oriented log, or use a structured serialization format with proper escaping.

6. Document what is logged, the storage location, retention period, deletion procedure, and security implications.

7. Provide a command or documented process for securely deleting existing history.

8. Add automated tests confirming that logging is opt-in, files are not accessible to other local users, and multiline input cannot forge records.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The declared description presents a marketing copywriting assistant centered on specific copywriting capabilities: extensive headline formulas, body copy, AIDA, pain points, testimonials, and landing-page copy. The code instead implements a lightweight command-line content assistant with mostly static outputs for generic content tasks such as outline, SEO, schedule, hooks, CTA, repurposing, metrics, and ideas. While some overlap exists around headlines and drafting, the primary behavior is broader content planning/optimization rather than the specific copywriting functionality claimed. Additionally, the script writes command history to a local data directory, which is an undeclared resource interaction. This is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file mixes English metadata with Chinese user-facing title/description content, and the main instructional text is presented in Chinese. This can amount to a language/locale policy violation because the skill effectively assumes a specific language without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script’s natural-language interface and all generated writing instructions are presented only in Chinese, beginning with the skill label and help text. Because the file does not offer any user choice of language or document a justified locale restriction, it appears to impose a specific language by default.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a marketing copy assistant focused on headline formulas, body copy, AIDA, pain points, testimonials, and landing-page copy. The actual commands expose broader content-production and content-strategy functions such as SEO tips, content scheduling, metrics, and repurposing, which materially exceeds the stated copywriting-focused behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script logs user-supplied content to a local history file without notice, which can expose sensitive prompts, campaign plans, customer data, or proprietary marketing text to other local users, backups, or forensic recovery. In a copywriting skill, users may paste confidential business information, making silent retention more risky than it appears.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest explicitly promises capabilities such as 100 headline formulas, AIDA framework support, pain-point mining, customer testimonials, and landing-page copy. The code only emits small fixed templates and does not implement those advertised functions or anything close to '100 headline formulas,' creating a clear mismatch between description and behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all substantive instructional content in Chinese, while the heading includes English, with no indication that the skill is intentionally region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.