Ads Landing Page Audit

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only ads landing-page audit skill with some broad routing language, but it does not install code, request credentials, or perform account changes automatically.

Safe to install as an advisory skill, but use it only for paid-traffic landing-page or funnel audits. Share only the campaign IDs, logs, policy flags, and owner contacts needed for the specific review, and treat budget, billing, containment, or escalation recommendations as draft advice requiring human approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is named and described as a landing-page auditor, but its body expands into broad ad-operations triage, policy, billing, anomaly response, and campaign containment workflows. That mismatch can cause an agent to invoke the skill in contexts far beyond its declared scope, increasing the chance of over-collection of sensitive operational data, inappropriate recommendations, or unintended execution paths in marketing and account-management scenarios.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger conditions are broad enough to match generic business, growth, and advertising conversations rather than narrowly targeting landing-page audits. In an agentic environment, this can lead to frequent misrouting, causing the skill to activate on unrelated requests and produce overly operational or platform-specific actions where they are not appropriate.

VirusTotal

66/66 vendors flagged this skill as clean.