Security audit

Adcp Advertising 1.0.1

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent advertising automation, but it includes examples that can change ad budgets and creative assignments without a real approval step, so it should be reviewed before use with production accounts.

Review this skill carefully before connecting production advertising credentials. Use it first against the test agent or a sandbox, require explicit human confirmation for every campaign launch, budget change, pause/resume action, and creative reassignment, and do not reuse the shared test token for real accounts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: EXAMPLES.md:678
Finding: Budget Reallocation Executes with Hard-Coded Approval
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation publishes what appears to be an actual bearer/auth token for a reachable test agent rather than a clearly fake placeholder. Even if intended for testing, exposed credentials can be abused for unauthorized access, quota consumption, service misuse, and they often get copied into downstream integrations or logs, expanding exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A real authentication token is embedded in public-facing example code without any indication that it is revoked, limited, or only illustrative. In a skill focused on ad buying and campaign automation, such a credential could enable direct interaction with the agent and potentially trigger actions, consume budgeted resources, or expose connected account data depending on the agent's permissions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The quick reference publishes a plaintext bearer token alongside a live test-agent endpoint, which can enable anyone reading the document to authenticate and perform network actions against that service. Even if intended for testing, exposed credentials are dangerous because they are easily reused, scraped, or relied on outside their original scope, and the skill’s advertising context increases risk since authenticated actions may create, modify, or inspect campaign-related resources.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A plaintext authentication token in documentation is a direct secret exposure vulnerability. If the token is valid or later reused, an attacker can leverage it for unauthorized access, and because this skill manages advertising operations, that access could affect campaign data, budgets, or other business-sensitive actions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
See [REFERENCE.md](REFERENCE.md) for complete API docs and [EXAMPLES.md](EXAMPLES.md) for detailed workflows.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 531)May include surrounding context.
md
See [REFERENCE.md](REFERENCE.md) for complete API docs and [EXAMPLES.md](EXAMPLES.md) for detailed workflows.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
See [REFERENCE.md](REFERENCE.md) for complete API docs and [EXAMPLES.md](EXAMPLES.md) for detailed workflows.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.
md
See [REFERENCE.md](REFERENCE.md) for complete API docs and [EXAMPLES.md](EXAMPLES.md) for detailed workflows.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 532)May include surrounding context.
md
See [REFERENCE.md](REFERENCE.md) for complete API docs and [EXAMPLES.md](EXAMPLES.md) for detailed workflows.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.
md
- [TARGETING.md](TARGETING.md) - Advanced targeting strategies

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 535)May include surrounding context.
md
- [CREATIVE.md](CREATIVE.md) - Creative asset management guide

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file demonstrates use of impression and click tracking endpoints as part of creative setup, which can affect user privacy and transmit interaction data. The guide does not include any warning or disclosure about analytics tracking, data handling, or consent considerations alongside these examples.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · CREATIVE.md (reported line 121)May include surrounding context.
md
}, click_through_url: 'https://brand.com/campaign', tracking_pixels: [ 'https://analytics.brand.com/impression?id=123', 'https://analytics.brand.com/click?id=123' ], status: 'active'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · CREATIVE.md (reported line 122)May include surrounding context.
md
}, click_through_url: 'https://brand.com/campaign', tracking_pixels: [ 'https://analytics.brand.com/impression?id=123', 'https://analytics.brand.com/click?id=123' ], status: 'active'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · CREATIVE.md (reported line 149)May include surrounding context.
md
}, click_through_url: 'https://brand.com/campaign', tracking_pixels: [ 'https://analytics.brand.com/impression?id=123', 'https://analytics.brand.com/click?id=123' ], status: 'active'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · CREATIVE.md (reported line 150)May include surrounding context.
md
}, click_through_url: 'https://brand.com/campaign', tracking_pixels: [ 'https://analytics.brand.com/impression?id=123', 'https://analytics.brand.com/click?id=123' ], status: 'active'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · REFERENCE.md (reported line 832)May include surrounding context.
md
}, click_through_url: 'https://brand.com/campaign', tracking_pixels: [ 'https://analytics.brand.com/impression?id=123', 'https://analytics.brand.com/click?id=123' ], status: 'active'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes a function that calls updateMediaBuy to alter active creative assignments based on performance results. Because this can materially change campaign delivery behavior, the documentation should clearly warn users that the example performs live configuration changes unless run in a test or review workflow.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · EXAMPLES.md (reported line 360)May include surrounding context.
md
}, click_through_url: 'https://streamtech.com/signup', tracking_pixels: [ 'https://analytics.streamtech.com/impression', 'https://analytics.streamtech.com/completion' ] }],

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · EXAMPLES.md (reported line 361)May include surrounding context.
md
}, click_through_url: 'https://streamtech.com/signup', tracking_pixels: [ 'https://analytics.streamtech.com/impression', 'https://analytics.streamtech.com/completion' ] }],

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The optimization example claims approval should be obtained in a real scenario, but the code hard-codes shouldOptimize = true and immediately performs updateMediaBuy to move live budget. In an advertising automation skill, this can trigger unauthorized spend changes and materially alter campaign delivery without explicit operator confirmation or policy checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The A/B testing example automatically updates live creative assignments to the 'winner' once a simplistic confidence condition is met, without an approval step or warning about production impact. In this skill's context, changing creative assignments affects active campaign behavior and spend allocation, so an example that normalizes unattended mutation can lead to unsafe operational changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The quick reference gives direct step-by-step instructions for creating and updating media buys but does not warn that these operations may spend money or alter live campaigns. In an agent skill, omission of such guardrails is risky because an automated system may treat the examples as safe defaults and execute cost-incurring or business-impacting actions without explicit human confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation presents test-agent credentials as copy-pasteable values without any caution that the token authenticates real network requests. This is dangerous because readers or downstream agents may misuse the credential, assume it is harmless, or embed it elsewhere, increasing the chance of unauthorized access or unintended actions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 14)May include surrounding context.
md
Transform how you run advertising campaigns. This skill provides OpenClaw agents with AI-powered advertising automation: - 🔍 **Discover ad inventory** - Find display ads, video placements, CTV spots using natural language - 🎯 **Launch campaigns instantly** - Create multi-channel campaigns across display, video, CTV, audio, native, DOOH - 🎨 **Manage ad creatives** - Upload banners, videos, HTML5 ads and track performance by creative - 📊 **Monitor ROI in real-time** - Get impressions, clicks, conversions, CPM, CTR, and spend data instantly - 🎛️ **Auto-optimize performance** - Reallocate budgets, pause underperformers, scale winners automatically

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: PROTOCOLS.md:393