Media Buyer Helper

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only advertising analysis helper with no code execution, credentials, persistence, or automatic account access.

Before installing, be aware that the skill may activate for vague marketing prompts because of broad keywords. Use it for paid advertising work, provide only the campaign data needed for the analysis, and manually review any recommendations to pause, limit, or reroute budgets before making changes in an ad platform.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger keywords are generic marketing terms like 'media', 'budget', 'campaign', and 'optimize', which are likely to appear in many unrelated requests. This can cause the skill to activate outside its intended scope, leading to incorrect routing, confused agent behavior, or unintended access to advertising-analysis workflows in conversations that only loosely mention marketing concepts.

VirusTotal

63/63 vendors flagged this skill as clean.