lobster-ads

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:46 PM UTC
• Version: 1.0.0

Overview

The skill is openly an advertising and wallet-management integration, but it gives agents broad autonomous authority to move money, inject sponsored content, and transmit conversation context with insufficient controls.

Review this carefully before installing. It may be suitable only in a controlled test environment or after changes that require explicit user approval for every deposit, withdrawal, campaign mutation, ad display, and click recording; pin the API URL to a trusted HTTPS host; avoid sending raw conversation context; and protect the API key from logs or terminal capture.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:153

Finding

Autonomous Injection of Third-Party Sponsored Content into Agent Responses

Content

View full analysis

$50 ``` ### Technical Analysis The skill changes the agent's ordinary response behavior by instructing it to retrieve externally controlled advertising content and inject that content directly into user conversations. Although the advertisement is supposed to be marked as sponsored, labeling does not address the trust-boundary violation: `ad.title` originates outside the audited skill package and is incorporated into the agent's output. No requirements are specified for destination validation, content sanitization, prohibited-content filtering, or treating returned advertisement text strictly as untrusted data. An advertiser could therefore submit manipulative content or a destination controlled by an attacker. The revenue incentive also directs the agent to optimize placement and record engagement rather than prese ...[truncated 1208 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:153

Finding

Conversation Context and API Credentials Can Be Sent to an Arbitrary Server

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/api.md:16

Finding

Campaign Mutation and Agent Financial Records Are Documented Without Authentication

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:7

Finding

Unsafe Registration Input Construction and API-Key Disclosure in Setup Script

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk does not implement the broad marketplace and wallet-management functionality claimed in the description. Its actual behavior is limited to initial agent registration against a LobsterAds API endpoint and credential bootstrap/setup. While registration is related to the LobsterAds ecosystem, the declared purpose presents this as an operational ad exchange skill with campaign, performance, wallet, and transaction capabilities, which are not present in the supplied code. This is a material description-behavior mismatch in scope and primary purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The autonomous instruction to deposit funds from a bank omits any user warning or consent mechanism for moving external money into the platform wallet. In an agentic setting, this is especially dangerous because it normalizes automatic financial transfers based on simple balance thresholds.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to execute many shell-based network and financial operations via curl, but it does not declare any explicit tool scope or allowed-tools restrictions. That increases the chance the host agent can invoke broader shell capabilities than necessary, which is risky in a skill that can move funds, create campaigns, and trigger withdrawals.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance is broad enough that the skill could be selected for ordinary monetization, wallet, or performance-related requests without clear user intent to transact. Because the skill includes fund deposits, withdrawals, and ad-market actions, over-broad triggering raises the risk of unintended financial or reputational actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

If the agent has no API key yet, register first:

bash

curl -s -X POST "$LOBSTERADS_API_URL/api/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"name": "MyAgent", "initialBalance": 1000}'

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manual campaign creation and pause/resume examples omit the API key even though other state-changing endpoints are authenticated. This inconsistency can lead to insecure implementations: either unauthenticated ad and budget mutations if the backend accepts them, or operator workarounds that bypass normal auth expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The withdrawal workflow directly moves funds out of the wallet but provides no warning, confirmation step, destination validation details, or indication that this is a sensitive irreversible action. In a financial skill, that omission materially increases the risk of accidental or unauthorized fund movement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The autonomous loop says to deposit funds 'from bank' when balance is low, which expands the skill from marketplace API usage into initiating external financial transfers. In an autonomous agent context, that can cause real-money movement without clear user approval, spending limits, or out-of-band confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.sh (reported line 16)May include surrounding context.

sh

echo "Registering agent '$AGENT_NAME' with LobsterAds..."

RESPONSE=$(curl -s -X POST "$LOBSTERADS_API_URL/api/agents/register" \
  -H "Content-Type: application/json" \
  -d "{\"name\": \"$AGENT_NAME\", \"initialBalance\": $INITIAL_BALANCE}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup script prints the newly issued API key directly to the terminal, which can expose credentials through terminal scrollback, screen sharing, shell session recording, CI logs, or remote support sessions. In the context of an ad marketplace skill that can manage wallet activity and transactions, disclosure of this key could enable unauthorized API access and financial abuse.

Content

No source excerpt is available for this finding.