Security audit

Ads Data Query

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only ads reporting and recommendation skill with no code, credentials, persistence, or direct ability to change accounts.

Installers should understand this skill as an ads analysis and planning aid, not an authorization mechanism. Review any budget, bidding, launch, or campaign-change recommendations before applying them in ad platforms, especially if another tool could consume the handoff payload.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation criteria combine analysis, optimization, and campaign execution language without clearly separating what the skill should and should not handle. This ambiguity increases the likelihood that the skill will be selected for tasks beyond safe query assistance, especially in contexts where generated recommendations may be consumed by automation or non-expert users.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is described as a data-query assistant, but its trigger conditions and workflow expand into campaign execution, optimization, and revenue-growth guidance. This scope drift can cause downstream systems or users to invoke the skill for higher-risk operational decisions than intended, increasing the chance of unauthorized or unsafe actions based on a tool that should be limited to reporting and query translation.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger keywords are broad terms such as revenue, profit, strategy, traffic, and conversion, which overlap with ordinary business conversations and can cause accidental invocation. Over-broad activation is dangerous in multi-skill agents because the wrong skill may capture prompts outside its intended scope and produce misleading or overly action-oriented outputs.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The output contract requires an execution-ready action plan and handoff payload, which goes beyond a query/reporting assistant and effectively positions the skill as an operational decision engine. In an agentic environment, this mismatch can lead to inappropriate automation, where analysis output is treated as approval or instruction for campaign changes without sufficient validation.

Static analysis

No suspicious patterns detected.