FB Ads Copywriter Pro

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:41 PM UTC
• Version: 2.1.0

Overview

This copywriting skill is not clearly malicious, but it needs Review because it embeds an API credential and can send user or questionnaire data to external services with weak scoping and warnings.

Review carefully before installing. Do not use this with confidential client, budget, or campaign data unless you are comfortable sending it to the listed third-party services. The publisher should remove and rotate the embedded GLM key, require explicit user-provided credentials, mask troubleshooting output, restrict questionnaire files to a safe directory, add a clear pre-send privacy confirmation, and pin dependencies. Run it in an isolated environment and avoid Telegram or email delivery unless you intentionally configure those channels.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/copy-generator.py:22

Finding

Hardcoded GLM API Credential Used as a Default

Content

View full analysis

Vulnerability Details

File Location: scripts/copy-generator.py:22-23, with credential use at scripts/copy-generator.py:73-78
Vulnerability Type: Hardcoded API credential
Risk Level: High

Vulnerable Code

python

GLM_API_KEY = os.getenv('GLM_API_KEY', 'sk-JSJg7OYHJZPOn87CpHq0d5VMGLkTCBdJcVxUOdUp06IpUABx')
GLM_API_URL = 'https://open.bigmodel.cn/api/paas/v4/chat/completions'

The embedded value is subsequently placed in the authorization header:

python

response = requests.post(
    GLM_API_URL,
    headers={
        'Authorization': f'Bearer {GLM_API_KEY}',
        'Content-Type': 'application/json'
    },

Technical Analysis

The application embeds a credential-shaped GLM API key as the default value used when the GLM_API_KEY environment variable is absent. Consequently, every copy of the package exposes the same credential to anyone able to read the source code.

The audit could not independently confirm whether the key remains active. Nevertheless, embedding and automatically using a bearer credential is an insecure coding practice. Source packages, repositories, build artifacts, logs, and backups are not appropriate secret-storage mechanisms.

The fallback also prevents the application from failing securely when configuration is missing. Instead of stopping and asking the user to provide their own credential, it silently uses the embedded credential.

Attack Path

1. An attacker downloads or otherwise obtains the publicly distributed Skill package.
2. The attacker reads scripts/copy-generator.py.
3. The attacker extracts the hardcoded bearer token from line 22.
4. If the token is active, the attacker submits arbitrary requests directly to the GLM API.
5. Those requests consume the credential owner's quota and may incur charges or trigger account-level rate limits.
6. Revocation of the shared credential can then disrupt every deployment relying on the fallb ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded fallback entirely:

   python

   GLM_API_KEY = os.getenv("GLM_API_KEY")
   if not GLM_API_KEY:
       raise RuntimeError("GLM_API_KEY must be configured")
   

2. Immediately revoke and rotate the exposed credential if it is or was active.

3. Require every deployment to use a separately provisioned credential with the minimum necessary API permissions and quota.

4. Store credentials in environment variables or a supported secret manager rather than source files.

5. Add automated secret scanning to source-control and publishing workflows.

6. Review repository history and previously published artifacts because removing the value from the current file does not remove earlier copies.

7. Configure usage alerts, rate limits, and billing limits for API credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/copy-generator.py:112

Finding

Arbitrary Questionnaire File Content Can Be Transmitted to an External API

Content

View full analysis

Vulnerability Details

File Location: scripts/copy-generator.py:112-130, with external transmission at scripts/copy-generator.py:69-91 and invocation at scripts/copy-generator.py:537-564
Vulnerability Type: Unrestricted local file input followed by external data transmission
Risk Level: Medium

Vulnerable Code

The questionnaire loader accepts any supplied readable path:

python

def load_questionnaire(filepath):
    """加載問卷數據"""
    
    try:
        with open(filepath, 'r', encoding='utf-8') as f:
            content = f.read()
        
        # 簡單解析 Markdown 格式問卷
        data = {}
        lines = content.split('\n')
        
        for line in lines:
            if line.startswith('- **'):
                parts = line.split('**')
                if len(parts) >= 3:
                    key = parts[1].strip()
                    value = parts[2].strip().lstrip(':').strip()
                    data[key] = value
        
        return data

Parsed values are inserted into the model prompt:

python

prompt = f"""
## 產品信息
產品名稱：{product_info.get('產品名稱', '未知產品')}
產品描述：{product_info.get('產品描述', '無')}
獨特賣點：{product_info.get('獨特賣點', '無')}
目標受眾：{product_info.get('目標受眾', '無')}
廣告預算：{product_info.get('廣告預算', '無')}
品牌風格：{product_info.get('品牌風格', '無')}
特別要求：{product_info.get('特別要求', '無')}

The prompt is sent to the external GLM endpoint:

python

response = requests.post(
    GLM_API_URL,
    headers={
        'Authorization': f'Bearer {GLM_API_KEY}',
        'Content-Type': 'application/json'
    },
    json={
        'model': 'glm-4-flash',
        'messages': [
            {'role': 'system', 'content': system_prompt},
            {'role': 'user', 'content': prompt}
        ],
        'temperature': 0.7,
        'max_tokens': 2000
    },
    timeout=60
)

Technical Analysis

The --questionnaire argument ...[truncated 2461 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict questionnaire files to a dedicated approved directory.

2. Resolve the supplied path and verify that it remains under that directory:

   python

   base = Path("memory/questionnaires").resolve()
   candidate = Path(filepath).resolve()
   
   if base not in candidate.parents:
       raise ValueError("Questionnaire path is outside the approved directory")
   

3. Reject symlinks or validate the final resolved target to prevent directory-boundary bypass.

4. Apply file-size limits before reading content.

5. Use an explicit schema and allowlist only the fields required for copy generation.

6. Redact credentials, personal identifiers, payment data, and unrelated questionnaire fields before constructing prompts.

7. Display the external destination and fields that will be transmitted, then obtain user confirmation for sensitive or user-supplied files.

8. Document the third-party provider's data handling, retention, region, and privacy implications.

9. Avoid transmitting the same sensitive fields six times where a single sanitized request or locally reused context would suffice.

10. Run the Skill with filesystem permissions limited to its working and questionnaire directories.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:560

Finding

Troubleshooting Documentation Prints the Full API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:560-567
Vulnerability Type: Credential disclosure through terminal and log output
Risk Level: Medium

Vulnerable Code

bash

# 檢查 API Key 是否正確
echo $GLM_API_KEY

# 重新設置
export GLM_API_KEY="your-correct-api-key"

Technical Analysis

The troubleshooting instructions advise users to print the complete GLM_API_KEY value. Terminal output is commonly retained in shell-session captures, CI logs, support transcripts, screen recordings, remote administration logs, and agent tool histories.

Printing the secret is unnecessary to determine whether the environment variable is present. It also encourages users to disclose the value when copying troubleshooting output into issue reports or support conversations.

Attack Path

1. A user encounters an API authorization error.
2. The user follows the documented troubleshooting command.
3. The complete API key is printed to the terminal.
4. The output is captured in a log, recording, support transcript, shared screenshot, or agent conversation.
5. A party with access to that captured output retrieves the credential.
6. If the key remains active, it is reused for unauthorized GLM API requests.

Impact Assessment

This issue exposes the GLM API credential rather than local system privileges. If the disclosed key is active, an attacker may consume quota, incur costs, disrupt legitimate API use, or cause account-level rate limiting. The exact impact depends on the permissions and billing configuration associated with the key.

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that print the complete credential.

2. Replace them with a presence check that does not reveal the value:

   bash

   if [ -n "${GLM_API_KEY:-}" ]; then
     echo "GLM_API_KEY is configured"
   else
     echo "GLM_API_KEY is not configured"
   fi
   

3. If diagnostic identification is required, display only a short masked suffix and never the full token.

4. Warn users not to include API keys in screenshots, logs, issue reports, or support messages.

5. Ensure application error messages do not include authorization headers or environment-variable values.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned and Unhashed Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2, with installation instructions in README.md:14-16 and SKILL.md:49-51
Vulnerability Type: Non-reproducible dependency resolution and supply-chain exposure
Risk Level: Low

Vulnerable Code

text

requests>=2.28.0
python-dotenv>=0.19.0

The documented installation process resolves these open-ended constraints directly:

bash

git clone https://github.com/vic-ai/fb-ads-copywriter-pro.git
cd fb-ads-copywriter-pro
pip install -r requirements.txt

Technical Analysis

Both dependencies use unrestricted lower-bound version constraints. A fresh installation can therefore resolve to future versions that were unavailable and unreviewed when the Skill was audited.

No hashes or lock file are supplied, so users cannot verify that they installed the exact artifacts reviewed by the publisher. If an upstream package, maintainer account, package-index path, or future release is compromised, installation may introduce malicious or vulnerable code.

The script imports requests, but no use of python-dotenv was identified in the reviewed implementation. Keeping an unused dependency unnecessarily increases the supply-chain attack surface.

No evidence was found that either named package is currently malicious or typosquatted. This finding concerns unsafe dependency-management practices rather than a confirmed malicious package.

Attack Path

1. A user follows the documented pip install -r requirements.txt command.
2. The package resolver selects the newest releases satisfying the lower bounds.
3. A selected release differs from the versions originally reviewed.
4. If that release or its distribution path is compromised, attacker-controlled code is installed into the user's Python environment.
5. Malicious package code may execute during installation or when imported by the Skill.

Impact Assessment

The potential impact ...[truncated 486 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dependencies to reviewed versions rather than open-ended minimum versions.
2. Generate and publish a lock file with cryptographic hashes.
3. Use hash-enforced installation, such as a requirements file compatible with pip install --require-hashes.
4. Review vulnerability advisories before each dependency update.
5. Perform upgrades through a controlled process that reruns security and compatibility tests.
6. Remove python-dotenv if it remains unused.
7. Install the Skill in an isolated virtual environment under a non-privileged account.
8. Avoid running package installation as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (47)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

The YARA hit is not proof of deliberate credential harvesting, but the file does combine multiple secrets, external HTTP posts, and messaging/email channels in one skill. More importantly, line 22 contains a hardcoded GLM API key fallback, which is an actual secret exposure and makes the overall pattern materially more dangerous if the code is shared or reused.

Content

Scanner excerpt · scripts/copy-generator.py (reported line 22)May include surrounding context.

python

!/usr/bin/env python3
"""
FB Ads Copywriter Pro - 核心生成腳本
功能：
1. 生成 6 個廣告版本（FOMO/社交證明/權威/痛點/促銷/故事）
2. A/B 測試建議
3. 受眾分析
4. 投放策略建議
5. Email 交付
6. Telegram 通知
"""

import os
import sys
import json
import requests
import argparse
from datetime import datetime
from pathlib import Path

# 配置
GLM_API_KEY = os.getenv('GLM_API_KEY', 'sk-JSJg7OYHJZPOn87CpHq0d5VMGLkTCBdJcVxUOdUp06IpUABx')
GLM_API_URL = 'https://open.bigmodel.cn/api/paas/v4/chat/completions'
RESEND_API_KEY = os.getenv('RESEND_API_KEY', '')
TELEGRAM_BOT_TOKEN = os.getenv('TELEGRAM_BOT_TOKEN', '')
TELEGRAM_CHAT_ID = os.getenv('TELEGRAM_CHAT_ID', '')

# 廣告風格定義
AD_STYLES = {
    'fomo': {
        'name': 'FOMO（恐懼錯過）',
        'emoji': '🔥',
        'description': '強調限時優惠、庫存緊張、錯過就沒有了',
        'keywords': ['最後', '限時', '搶購', '告急', '錯過']
    },
    'social_pro

Tainted flow: 'GLM_API_KEY' from os.getenv (line 22, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/copy-generator.py (reported line 73)May include surrounding context.

python

"""使用 GLM-4-Flash 生成內容"""
    
    try:
        response = requests.post(
            GLM_API_URL,
            headers={
                'Authorization': f'Bearer {GLM_API_KEY}',

Tainted flow: 'RESEND_API_KEY' from os.getenv (line 24, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/copy-generator.py (reported line 457)May include surrounding context.

python

return False
    
    try:
        response = requests.post(
            'https://api.resend.com/emails',
            headers={
                'Authorization': f'Bearer {RESEND_API_KEY}',

Tainted flow: 'TELEGRAM_BOT_TOKEN' from os.getenv (line 25, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/copy-generator.py (reported line 494)May include surrounding context.

python

return False
    
    try:
        response = requests.post(
            f'https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage',
            json={
                'chat_id': chat_id,

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is ad copy generation, but the documented behavior expands into external delivery, local file persistence, and third-party API transmission of questionnaire and client content. This mismatch is dangerous because users may provide commercially sensitive or personal marketing data under the assumption of a narrower, local-only copywriting function.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: fb-ads-copywriter-pro
description: Facebook 廣告文案專家 - 生成 6 個高轉化率廣告版本，包含 A/B 測試建議和受眾分析
author: Vic AI Company
version: 2.1.0
metadata: {"emoji": "📝", "category": "marketing", "tags": ["facebook-ads", "copywriting", "marketing", "ai", "clawhub"]}
clawhub_pricing:
  single: $3 USD/次（6 文案 +6 圖片 +UTM+ 第 7 日報告，無試用）
  subscription: $29-199 USD/月
---

# FB Ads Copywriter Pro - Facebook 廣告文案專家

**專業級 Facebook 廣告文案生成工具，6 個廣告版本 + A/B 測試建議 + 受眾分析 + 投放策略**

---

## �

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

設置 GLM API Key

export GLM_API_KEY="your-glm-api-key"

或創建 .env 文件

echo "GLM_API_KEY=your-glm-api-key" > .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

設置 GLM API Key

export GLM_API_KEY="your-glm-api-key"

或創建 .env 文件

echo "GLM_API_KEY=your-glm-api-key" > .env

text

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/copy-generator.py (reported line 33)May include surrounding context.

python

OYHJZPOn87CpHq0d5VMGLkTCBdJcVxUOdUp06IpUABx')
GLM_API_URL = 'https://open.bigmodel.cn/api/paas/v4/chat/completions'
RESEND_API_KEY = os.getenv('RESEND_API_KEY', '')
TELEGRAM_BOT_TOKEN = os.getenv('TELEGRAM_BOT_TOKEN', '')
TELEGRAM_CHAT_ID = os.getenv('TELEGRAM_CHAT_ID', '')

# 廣告風格定義
AD_STYLES = {
    'fomo': {
        'name': 'FOMO（恐懼錯過）',
        'emoji': '🔥',
        'description': '強調限時優惠、庫存緊張、錯過就沒有了',
        'keywords': ['最後', '限時', '搶購', '告急', '錯過']
    },
    'social_proof': {
        'name': '社交證明',
        'emoji': '👥',
        'description': '強調用戶評價、銷量、推薦人數',
        'keywords': ['評價', '銷量', '選擇', '推薦', '用戶']
    },
    'authority': {
        'name': '權威背書',
        'emoji': '👩‍⚕️',
        'description': '強調專家推薦、科學驗證、專業認證',
        'keywords': ['醫生', '專家', '認證', '臨床', '�

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all operational and publishing instructions exclusively in Chinese, with no indication that users can choose another language or that the language restriction is intentional and justified. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist describes capabilities materially broader than the stated skill purpose of Facebook ad copywriting, including image generation, automated reporting, email delivery, and Telegram notifications. Scope expansion like this can hide additional data flows, third-party API usage, and outbound communications that users and reviewers would not reasonably expect from a copywriting skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Stability AI image-generation integration adds third-party processing beyond the stated copywriting scope. Even if intended as a product enhancement, it can cause undisclosed transmission of prompts, campaign details, or brand assets to an external provider, which is a material security and privacy consideration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Email delivery and Telegram notifications introduce outbound communication channels unrelated to basic ad-copy generation. These features can expose generated content, customer inputs, or campaign metadata to external destinations, increasing the risk of unauthorized data sharing or misuse if not clearly justified and consented to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises email and Telegram delivery features and instructs users to configure third-party service credentials, but it does not warn that generated ad copy or questionnaire-derived content may be transmitted off-platform to external providers. This can lead to unintentional disclosure of client, marketing, or personal data, especially because the skill explicitly supports questionnaire input and notification delivery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The feature list explicitly states '粵語口語化創作', which indicates the skill produces Cantonese colloquial copy. There is no nearby indication that users can opt into another language or locale, so this may violate language-choice policy for a general-purpose copywriting skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises operational capabilities involving environment variables, filesystem access, and network use, but does not declare any explicit tool scope or permissions boundary. This creates a transparency and containment problem: users and hosting platforms cannot easily enforce least privilege or understand that the skill may read local files, write outputs, and transmit data externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that the skill creates colloquial Cantonese copy for the local Hong Kong market, which imposes a specific language/locale behavior. Although later configuration mentions a language option, the main description presents the locale constraint as default behavior without clearly offering user choice at the point of use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes automatic email and Telegram delivery without warning that generated content and possibly questionnaire-derived client data will be sent to third-party services. In a marketing workflow, those materials can include unreleased campaigns, customer details, pricing, or business strategy, so silent transmission increases confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage example normalizes sending outputs to client email and Telegram immediately after generation, but provides no caution about forwarding potentially sensitive marketing materials or questionnaire-derived data. Example commands strongly influence operator behavior, so omission of warnings materially increases the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest text specifies Cantonese-focused behavior, including '粵語口語化創作', but does not indicate that users can choose another language or opt into this locale-specific output. This is a natural-language policy concern because the skill appears to enforce a specific language/locale by default rather than offering a choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The suggestions recommend adding generic trigger terms such as "create," "build," "skill," "when," and "use" without constraining them to Facebook ad copywriting. Overly broad triggers can cause the skill to activate in unrelated contexts, increasing the chance of unintended invocation and user confusion, though this is more of a quality and routing risk than a direct security exploit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The recommendation to add fixed triggers like "中文" and "English" can bias activation based on language alone rather than user intent. This may cause the skill to trigger for any Chinese- or English-language request, even when the user did not ask for Facebook ad copywriting, leading to misrouting and unexpected behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The system prompt states that the model specializes in Cantonese copywriting, which imposes a specific language/locale in the skill behavior. Because the document does not indicate that users can choose another language or explicitly opt in to Cantonese, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described as an ad-copy generator, but the documentation also includes outbound email delivery through Resend. That creates a capability mismatch: generated content could be transmitted to external recipients without that behavior being clearly reflected in the skill’s stated purpose, increasing the risk of undisclosed data exfiltration, spam, or unauthorized outbound communications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

For a copywriter skill, email delivery is not necessary to generate ad text, so its presence expands the attack surface beyond the justified function. Even if intended for convenience, it enables the skill to perform unsolicited outbound actions and transmit potentially sensitive business content or user-supplied marketing data to third parties.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.