ads

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:44 AM UTC
• Version: 1.0.0

Overview

This paid-ads skill is mostly coherent, but it should be reviewed because it can guide live ad-account changes and customer-data advertising workflows without clear confirmation or privacy controls.

Review before installing. Use this skill in read-only or advisory mode unless you explicitly approve specific changes; require a summary and confirmation before any campaign launch, pause, budget change, audience upload, or tracking deployment. Before uploading emails, phone numbers, CRM lists, or using pixels/CAPI/enhanced conversions, verify consent or another lawful basis, platform policy compliance, opt-out handling, retention/deletion rules, and internal privacy review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/b2b-paid-playbook.md (reported line 69)May include surrounding context.

md

- **Non-performer rule** (new ads, any time): pause once an ad has spent **2–3× target CPL with zero conversions**. Target CPL $300 → kill at $600–900 spent, no conversions.
- **Maintenance rule** (ads past ~7–14 days): pause when an ad's CPL runs **1.5–2× over target**. Target $300 → kill at $450–600 CPL.

These aren't statistically rigorous — they're repeatable, cheap to apply, and better than deciding by mood. Never pause a producer without a replacement staged (see the swap rules in the [Meta decision system](meta-decision-system.md)).

## The optimize-to-quality trap (and the offline conversion loop)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/meta-decision-system.md (reported line 14)May include surrounding context.

md

- Stage 2: quality evaluation (weekly)
- Graduation criteria
- Fatigue detection
- Swap rules
- Creative production math
- Scaling protocol
- Weekly cadence

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/meta-decision-system.md (reported line 96)May include surrounding context.

md

- Stage 2: quality evaluation (weekly)
- Graduation criteria
- Fatigue detection
- Swap rules
- Creative production math
- Scaling protocol
- Weekly cadence

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is extremely broad and includes many generic paid-marketing terms, making accidental or premature invocation likely in conversations that only loosely relate to advertising. In a skill that provides tactical campaign guidance and references operational playbooks, over-invocation can cause the agent to steer users into ad-account decisions without sufficient scoping or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that it has direct access to ad platform accounts and then provides guidance for live operational decisions, but it does not require explicit user authorization, confirmation gates, or warnings before account-impacting actions. In a live advertising context, mistaken execution can immediately spend money, alter delivery, pause campaigns, or degrade performance on production accounts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The eval explicitly rewards the skill for triggering on casual phrasing ('we want to run retargeting ads...') without also asserting clear scope boundaries or disambiguation. In a routing or skill-selection system, broad trigger expectations can cause over-selection of the ads skill for loosely related marketing requests, increasing the chance of misrouting, context bleed, or inappropriate advice being applied where another skill should handle the task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The playbook advises using identity-graph enrichment, uploading matched audiences, and targeting people across platforms without any warning about consent, lawful basis, platform policy, or regional privacy restrictions. In a marketing operations skill, these instructions could directly lead users to process personal data for ad targeting in ways that violate privacy laws or internal data-handling requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cross-channel UTM remarketing section gives step-by-step instructions for tracking users from one ad platform and retargeting them on another, but omits any warning that this may require disclosure, consent, and compliant cookie/tracking configuration. Because the skill is explicitly operational and prescriptive, users may implement cross-platform retargeting directly without considering privacy obligations or user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance tells operators to upload customer email lists for ad targeting but omits any requirement to verify consent, lawful basis, platform policy compliance, minimization, or secure handling of personal data. In a marketing skill, this can normalize privacy-noncompliant audience creation and lead to misuse of customer PII across ad platforms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section specifically recommends uploading emails and phone numbers into Meta Custom Audiences without warning about consent, notice, retention, or handling restrictions for personal data. Because the skill is operational marketing guidance, users may directly apply it in production campaigns, creating privacy and compliance exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs users to send first-party identifiers such as email and phone for Enhanced Conversions without placing a prominent privacy/compliance warning at the point of implementation. Even if the platform auto-hashes the data, it is still personal data and can create unlawful collection or disclosure risk if implementers deploy it without valid notice, consent, and documented legal basis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Meta CAPI section recommends server-side transmission of user and event data to a third party but does not clearly warn at that location about privacy, consent, and disclosure obligations. Server-side tracking is especially sensitive because it can bypass browser-side controls and expand the scope of data sharing, increasing regulatory and user-trust risk if deployed carelessly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/conversion-tracking.md (reported line 237)May include surrounding context.

md

for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);
    ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;
    n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};
    ttq.load=function(e,n){var r="https://analytics.tiktok.com/i18n/pixel/events.js",
    o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,
    ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},
    ttq._o[e]=n||{};var s=document.createElement("script");

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The TikTok advanced matching example shows sending email and phone data for attribution improvement without an immediate privacy warning. Although the snippet notes auto-hashing, hashing does not eliminate privacy obligations, and implementers may incorrectly assume the transfer is low risk or exempt from consent and notice requirements.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/conversion-tracking.md (reported line 340)May include surrounding context.

md

- **Not testing on mobile** — many pixels break on mobile browsers or in-app webviews
- **Hardcoded test values** — remove test transaction amounts before going live
- **Forgetting to exclude internal traffic** — your team's visits inflate conversion data
- **Installing pixels without consent management** — GDPR/CCPA require user consent before firing tracking pixels in applicable regions
- **Pixel installed but no conversion actions created** — the pixel collects data, but the ad platform won't optimize without defined conversion actions

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The checklist directs operators to upload customer/contact lists and configure extensive tracking across ad platforms, but it omits safeguards around consent, lawful basis, notice, retention, and platform-specific data use restrictions. In an advertising setup skill, this omission is materially risky because users may implement remarketing and customer matching with personal data in ways that violate privacy laws, contracts, or internal policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The checklist explicitly requires that, for medical/CFM cases, the language be pt-BR. This is a natural-language locale constraint stated as mandatory behavior, and the file does not offer the user a language choice or opt-in for that requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The advice to upload target account lists and use employee email-based exclusions lacks any caution about whether those identifiers were collected appropriately or can be shared with ad platforms. While less severe than broad customer retargeting guidance, it still encourages transfer of business-contact or employee data without privacy safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

L097 explicitly suggests scaling via new countries/regions, but the document provides no accompanying instruction to adapt language or obtain user/client opt-in for locale-specific changes. Because SQP-3 covers language or locale policy violations in natural language, this is a mild policy gap tied to cross-region expansion guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.