Security audit
website-to-ads
Security checks for vulnerabilities and agentic risk
Overview
The skill's code and runtime instructions mostly match its stated purpose (scrape -> analyze -> generate ads), but there are packaging and declaration inconsistencies (missing declared env requirements and no install spec despite dependencies) that warrant caution before installing or running it with real credentials.
This skill appears to do what it claims (scrape with Apify, analyze/generate with OpenAI, optional Civic verification) but the package metadata is inconsistent and incomplete. Before installing or running it: - Treat APIFY_TOKEN and OPENAI_API_KEY as required — do not paste production keys into examples or public places. The platform's metadata did not declare these, so verify where/how you'll supply secrets. - The package includes Node dependencies (apify-client, openai, @civic/auth-verify) but no install spec; ensure your runtime will install/contain these safely or run the code locally after inspecting it. - The code writes a .cache/<md5>.json file in the current working directory containing scraped content and derived brand profile; review and secure that data, and consider clearing or isolating the cache if it contains sensitive content. - The Civic flow is optional; if enabled the code will call Civic verify endpoints and may require CIVIC_CLIENT_ID or CIVIC_GATEWAY_KEY. Do not store long-lived tokens in example files; rotate any tokens used for testing. - The 'offensive' ad tone explicitly asks the model to generate abusive content — avoid using that tone in production or where it could violate platform policies or laws. If you plan to use this skill for real sites or with real credentials, review the source (already included), run it in a controlled environment, and correct the skill metadata (declare required env vars and clarify install steps) before deploying broadly.
SkillSpector findings are pending for this release.