ClawHub
Back to skill

Security audit

Generate High-Converting TikTok Ads for Shopify (UGC + Viral Hooks + A/B Testing)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow ad-copy generator, but it includes instructions that may make sponsored TikTok ads appear unscripted or accidental without clear disclosure guardrails.

Review this skill carefully before installing if you use it for real ads. It should be constrained to transparent, policy-compliant sponsored content, with required disclosures and truthful claims; avoid using the Reali-TEA guidance to make paid promotions look like spontaneous unpaid recommendations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly promotes making ads appear 'genuinely unscripted' through intentional imperfections, accidental-looking product reveals, and forgotten-sounding CTAs, but provides no warning about disclosure, truth-in-advertising, or platform advertising compliance. In an ad-generation skill, this materially increases the risk of producing deceptive marketing content that misleads consumers about authenticity or endorsement style.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This is a real issue: the skill explicitly instructs the model to create advertising that simulates 'unscripted' human behavior and 'accidental' product reveals, while omitting any warning about deceptive or policy-sensitive use. That increases the risk of generating manipulative sponsored content that obscures its commercial nature and could violate advertising disclosure standards or platform policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The placeholder text hard-codes an example target audience as "Women aged 25-40," which nudges use toward a specific demographic category in natural-language instructions. Because this is a config file and there is no accompanying opt-in, neutrality note, or justification for demographic targeting, it can be read as encouraging a fixed audience framing rather than offering a neutral or user-selected policy-aware choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.