ClawHub
Back to skill

Security audit

Ad Copy Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a simple ad-copy writing skill with no code execution or privileged access, but users should apply advertising compliance judgment for health and supplement claims.

Before installing, treat this as a copywriting aid rather than legal or platform-policy review. Be especially careful with weight loss, supplements, health, finance, employment, testimonials, and quantified results; verify claims, avoid fabricated outcomes, and review ads against the relevant platform and jurisdiction rules. The Telegram Pro upsell is disclosed but off-platform, so evaluate that separately before paying.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill explicitly encourages generating ad copy for sensitive domains such as weight loss, supplements, and similar conversion-focused campaigns without any safety guardrails, disclaimers, or compliance guidance. This can facilitate misleading, non-compliant, or manipulative marketing content in regulated or harm-prone categories, increasing legal, trust, and consumer-harm risk even though it is not an exploit in the traditional code-execution sense.

Static analysis

No suspicious patterns detected.