Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent marketing skill pack, but it includes under-scoped guidance for high-impact account/tool actions and optional commands that execute mutable third-party code.
Review this skill before installing in environments with ad accounts, CRM/billing access, API keys, or private customer data. Avoid running the optional git clone/make or npx examples unless you pin versions, inspect the code, and use a disposable sandbox; require explicit confirmation before any campaign, CRM, billing, email, crawler-access, or voice-cloning action.
skills/ad-creative/references/generative-tools.md:416Execution of Mutable Third-Party Repository Code Without Integrity Verification
skills/ad-creative/references/generative-tools.md:562Unpinned npm Package Retrieval and Execution Through npx
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
## Common Mistakes
- **Writing headlines that only work together** — RSA headlines get combined randomly
- **Ignoring character limits** — Platforms truncate without warning
- **All variations sound the same** — Vary angles, not just word choice
- **No CTA headlines** — RSAs need action-oriented headlines to drive clicks; include at least 2-3
- **Generic descriptions** — "Learn more about our solution" wastes the slot
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
**Structure:** Trigger/Pain → Solution hint → Binary CTA. 1–3 sentences, no intro.
**Best for:** High-velocity SDR teams. Mobile-optimized. Deliberately polarizing.
Spend max 1 minute on personalization. Use industry/persona-level signals. For top-tier prospects, quote their own words from interviews — they almost always respond.
## Vanilla Ice Cream (Lavender)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
All major headless CMS platforms support draft previews:
- **Sanity**: Real-time preview with `useLiveQuery` or Presentation tool
- **Contentful**: Preview API (`preview.contentful.com`) with separate access token
- **Strapi**: Draft & Publish system with `status=draft` query parameter (v5; replaces v4's `publicationState`)
Set up a preview route in your frontend (e.g., `/api/preview`) that authenticates and renders draft content.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Cool-down period after dismiss (hours vs. days)
- Escalating urgency over time vs. consistent messaging
- Once per feature vs. consolidated prompts
- Re-show rules after major engagement
### Dismiss Behavior
- "Maybe later" vs. "No thanks" vs. "Remind me tomorrow"
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
<Head>
<script
type="application/ld+json"
dangerouslySetInnerHTML={{ __html: JSON.stringify(schema) }}
/>
</Head>
{/* Page content */}
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
<p align="center">
<a href="https://myclaw.ai"><b>MyClaw.ai</b></a> is the #1 OpenClaw host — the best way to run OpenClaw.<br>
Get your own AI agent with a full server, complete code control, and unlimited tool access.<br>
No setup. No DevOps. Just your agent, ready to work.
</p>
The section says users can "use any skill naturally" and then lists example utterances, but it does not define whether these are the only triggers, preferred examples, or merely illustrative mappings. Without clear boundaries or exclusion conditions, multiple skills may plausibly match common requests like writing copy or auditing SEO.
The README presents "Help me with Google Ads" as a natural invocation for the paid-ads skill. This phrasing is broad, conversational language that could easily appear in ordinary chat, increasing the risk of unintended skill activation if trigger matching is based on natural-language examples.
The README presents very broad natural-language phrases like '优化这个落地页的转化率' and '帮我投Google广告' as triggers for skill use. In agentic environments, generic requests can unintentionally match and invoke this skill during normal conversation, causing capability overreach, unexpected file access to shared context files, or execution of marketing-oriented workflows when the user did not explicitly request the installed skill.
The README says 'Just ask naturally' and provides examples like 'Help me with Google Ads,' which overlap with common user phrasing and do not define clear trigger boundaries. This can cause unintended invocation of the marketing skills when a user is speaking generally rather than explicitly requesting a specific skill.
The trigger list is excessively broad and includes generic phrases like "hypothesis," "which version is better," and "test this change," which can cause this skill to activate during ordinary product or strategy discussions rather than only explicit experimentation requests. In an agentic system, over-triggering can misroute user intent, override more appropriate skills, and lead to unnecessary file reads or follow-up actions under the wrong workflow.
The skill description contains many broad trigger phrases such as generic requests for ads or variations, which can cause the orchestration layer to invoke this skill in situations where a more specific or safer skill would be a better match. This is not directly exploitative, but it can lead to misrouting, over-collection of context, or unintended tool/use flows in multi-skill environments.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API example:
# Using the Gemini API for image generation
curl -X POST "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:generateContent" \
-H "Content-Type: application/json" \
-H "x-goog-api-key: $GEMINI_API_KEY" \
-d '{
The skill recommends brand voice cloning workflows without warning that voice cloning requires explicit consent and can enable impersonation, fraud, or misuse of sensitive audio. In a marketing skill, this omission is more dangerous because it normalizes production use of cloned voices for ads at scale, increasing the chance of unauthorized cloning.
The ElevenLabs section explicitly promotes cloning a spokesperson's voice and multilingual reuse but omits any consent, disclosure, or authorized-use safeguards. Because the content is instructional and operational, users may interpret cloning as a standard approved marketing tactic even when they lack rights to the voice or recording.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API example:
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" \
-H "xi-api-key: $ELEVENLABS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API example:
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" \
-H "xi-api-key: $ELEVENLABS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The open-source Voicebox section lowers cost and friction for local voice cloning while providing install and API usage details, but it lacks any warning about consent, rights-sensitive source audio, or impersonation abuse. That combination materially increases misuse risk because it enables private cloning outside hosted-provider safeguards.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The manifest description says to use the skill 'whenever someone wants their content to be cited or surfaced by AI assistants and AI search engines,' which is a broad activation condition beyond the specific keyword list. This can overlap with many ordinary marketing or content-strategy requests and does not provide clear exclusion boundaries beyond two adjacent skills.
The document explicitly advises users to allow multiple AI crawlers and states that options to separate citation from training are limited, but it does not warn about the privacy, confidentiality, licensing, and data-governance consequences of making content broadly accessible to those bots. In a marketing/SEO skill, users may apply this guidance directly to production sites and unintentionally expose sensitive, proprietary, customer, or regulated content to indexing and possible model-training pipelines.
The trigger description is very broad and includes generic phrases like 'how do I measure this' or 'how to know if something is working,' which can cause the skill to activate outside narrow analytics-tracking tasks. This is not an exploit in itself, but it can misroute agent behavior, leading to irrelevant guidance, increased context consumption, or accidental use in situations where more appropriate skills should handle the request.
This reference explicitly recommends tracking persistent identifiers and rich context such as user_id, account_id, session_id, referrer, campaign data, and transaction details, but provides no privacy, minimization, consent, retention, or redaction guidance. In a marketing analytics skill, that omission can lead downstream users to implement broad user tracking in ways that violate internal policy or privacy regulations, and may also result in accidental collection of sensitive data in fields like referrer or error_message.
No suspicious patterns detected.