Security audit
Security checks for vulnerabilities and agentic risk
This is a Portuguese paid-traffic marketing guidance skill with no executable code, hidden commands, credential handling, or persistence behavior found.
Install this if you want Portuguese-language paid-traffic strategy assistance. Review outputs carefully before applying recommendations to real ad accounts or budgets, since the skill provides guidance but does not itself enforce platform-specific safety checks.
The manifest description says 'Use para ads, Facebook, Google, YouTube, scaling campaigns, budget management,' which is a wide set of common marketing topics rather than a narrowly defined activation scope. Because it does not define explicit trigger phrases, boundaries, or exclusion cases, the skill could be invoked for many ordinary marketing-related requests unintentionally.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Tasks Disponíveis
- create-ad-strategy - Create ad strategy
- audit-ad-account - Audit ad account
- create-ad-creative - Create ad creative
- setup-tracking - Setup tracking/pixels
The description is written only in Portuguese ('Squad de 16 especialistas em paid traffic'), which indicates a fixed language choice in user-facing metadata. There is no indication elsewhere in the manifest that users can choose their preferred language or that the locale restriction is intentional and justified.
Multiple user-facing sections, including the description and usage examples, are presented in Portuguese, but the file does not state that the skill is Portuguese-only or offer a language choice. This can violate language/locale policy when a skill implicitly forces a language without user opt-in or justification.
No suspicious patterns detected.