Security audit

website to ads

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its advertised ad-generation purpose, but it includes an under-disclosed mode for abusive ad copy plus sensitive token and caching patterns that need review before use.

Review this skill before installing. Use it only for websites you own or are authorized to analyze, assume submitted site content may be sent to Apify and OpenAI, remove or disable the offensive tone, avoid exposing Civic access tokens to the browser, and clear the local .cache directory when scraped content should not remain on disk.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation indicates use of environment variables and network-enabled tools, but no explicit permissions are declared. This creates a transparency and governance gap: an agent or reviewer may not realize the skill can access secrets and make outbound requests, which increases the risk of unintended data exposure or misuse of credentials during execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This route returns a raw Civic access token directly to any caller of the endpoint, effectively turning a server-side credential retrieval mechanism into a token exfiltration API. In the context of an ad-generation skill, exposing authentication tokens is not necessary for core functionality and increases the risk that browser JavaScript, third-party scripts, logs, or an attacker who can trigger the route could obtain and misuse the token against Civic-backed resources.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The code intentionally supports an 'offensive' tone whose instructions direct the model to generate abusive, humiliating, and antagonistic ad copy. In a marketing skill, this is unjustified by the stated purpose and materially increases the chance of generating harassment, hateful or policy-violating content that could be deployed at scale.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The instructions explicitly encourage insults, personal attacks, mockery of insecurities, and discomfort as a creative goal. Because this is an ad-generation pipeline, the skill context makes it more dangerous: it can mass-produce abusive marketing content aimed at real audiences and brands.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README states that website content is scraped and processed via Apify and OpenAI, but it does not clearly warn users that scraped site content will be transmitted to third-party services. This creates a real privacy and compliance risk because users may submit URLs containing copyrighted, sensitive, or regulated content without informed consent or understanding of where that data is sent.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The route sends a sensitive access token in a JSON response without any user disclosure, consent step, or indication that a reusable credential is being exposed to the client. While the core issue is the exposure itself, the lack of warning makes accidental insecure integration more likely and can cause downstream developers to treat the token as ordinary application data.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The description advertises broad website scraping and ad generation without meaningful constraints on allowed targets, consent requirements, or content boundaries. In an agent ecosystem, underspecified activation language can cause the skill to be invoked for arbitrary third-party sites and marketing copy generation, increasing the risk of unauthorized scraping, policy violations, or abusive promotional content.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The 'offensive' prompt text directly instructs the model to produce abusive and insulting content targeting users and groups, including personal attacks and humiliation. This is dangerous because it operationalizes harmful content generation as a first-class feature, creating brand, legal, platform-policy, and user-harm risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill writes scraped website content and derived brand data to a local .cache file for 24 hours without any user consent, notice, or opt-in. In this context, the scraped content may include business-sensitive material, personal data, or copyrighted text from arbitrary URLs, so silent persistence increases privacy and data-handling risk, especially on shared machines or multi-tenant runners.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The manifest exposes a workflow that scrapes third-party websites and accepts a `civic_token` for authenticated export, but it does not warn users that website content will be transmitted to external services or that the token is sensitive authentication material. This creates a real security and privacy risk because users may provide business URLs or identity tokens without understanding where data goes, how it is used, or how credentials should be handled.

Ssd 1

Medium

Confidence: 98% confidence
Finding: Untrusted scraped website content is interpolated directly into the model input, so prompt-injection text on the target site can override the intended extraction task and cause the model to return manipulated JSON, misleading brand attributes, or non-JSON output that breaks downstream processing. In this skill context, the risk is heightened because arbitrary external websites are the primary input, making attacker-controlled prompt content a normal operating condition rather than an edge case.

Ssd 1

High

Confidence: 98% confidence
Finding: Phrases such as 'ALL LIMITS OFF' and 'ZERO content restrictions' are explicit attempts to disable safety boundaries and steer the model away from normal safeguards. In a user-facing generation system, this increases the likelihood of unsafe output and makes downstream moderation harder because the unsafe behavior is embedded in the system prompt itself.

Ssd 2

High

Confidence: 97% confidence
Finding: The prompt uses paraphrased attack language to encourage harassment and degradation without relying on standard jailbreak wording, which can still effectively induce unsafe model behavior. This is dangerous because it is intentionally crafted to elicit abusive content while evading simplistic keyword-based safeguards.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The instructions progressively escalate from humor to shock, insults, humiliation, and crossing lines, normalizing increasingly harmful behavior as a quality target. While this pattern is less direct than an exploit primitive, in context it systematically pushes the model toward policy-violating and harmful outputs.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/auth.ts:7

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: examples/civic-nextjs-token-route.ts:19