Security audit

Paid Advertising

Security checks for vulnerabilities and agentic risk

Overview

This is a plain paid-advertising guidance skill with no code execution, persistence, or hidden access, though users should add privacy and consent checks before using its tracking or audience advice.

Install only if you want a paid-advertising playbook. Before following its tracking, retargeting, or custom-audience steps, confirm your privacy notices, consent flow, platform terms, and handling of email lists or visitor data are appropriate for your business and users.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes broad phrases like "paid ads," "run ads," and "advertising strategy," which can cause the skill to activate in contexts where the user did not intend to invoke a full paid-advertising workflow. This is not a code-execution issue, but it can lead to misrouting, irrelevant guidance, and accidental exposure of persuasive marketing playbooks in unrelated conversations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This section instructs users to install ad-platform tracking technologies and measure conversions, but it omits any warning about obtaining consent, complying with privacy laws, or minimizing data collection. In practice, this can lead operators to deploy tracking pixels and tags unlawfully or without adequate disclosure, exposing visitor behavioral data to third parties.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The retargeting and custom-audience guidance tells users to reuse website visitor data, email lists, and engagement data for ad targeting without warning about consent, notice, hashing/upload requirements, or restrictions on sensitive categories. That omission increases the risk of improper audience building, unauthorized sharing of personal data, and noncompliance with ad-platform and privacy-law requirements.