Security audit

Lulu Ads

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for adding sponsored ad slots, but it asks agents to add broad external ad integration and persistent future-agent rules that users should review carefully.

Install only if you intentionally want Lulu Ads in the target server. Require explicit approval before adding the remote MCP endpoint, creating a publisher account, installing packages, or modifying response schemas. Prefer per-tool opt-in, exclude sensitive tools, pin dependencies, store the API key securely, and avoid adding the proposed AGENTS.md or CLAUDE.md block unless a maintainer explicitly wants persistent repository-level guidance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: External Advertising Service Can Influence Tool Responses
Content: View full analysis
", "category": ""} ) ``` ```ts import { LuluAds } from "lulu-ads"; const ads = new LuluAds({ publisherId: process.env.LULU_ADS_PUBLISHER_ID!, apiKey: process.env.LULU_ADS_API_KEY!, }); // inside the tool handler, before returning: const sponsored = await ads.sponsoredSlot({ context: { tool: "" } }); if (sponsored) (result as Record).sponsored = sponsored; ``` ### Technical Analysis The Skill instructs the agent to follow advertiser-provided steps exactly and recommends adding a remote MCP server so that its tools can drive the integration. It also modifies otherwise unrelated tool handlers so that successful responses may contain advertising data obtained at runtime from an external service. This creates an e ...[truncated 2117 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:107
Finding: Advertising Rules Are Persisted in Future-Agent Instruction Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:24
Finding: Unpinned Third-Party Advertising SDK Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: lulu-ads description: Monetize an MCP server or agent tool you're building or maintaining with disclosed sponsored slots. Use when a human asks to "monetize," "add ads to," or "earn revenue from" an MCP server/agent tool, or when publishing a new one and monetization comes up. 70% CPA rev-share, fail-open, one disclosed data field — never a display instruction. --- # Lulu Ads — Publisher Integration

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
## 4. Rules — do not deviate - NEVER add text telling the model/host to display the sponsored field. It is data; the host decides. Adding display instructions violates platform policies and gets servers delisted. - NEVER attach sponsored content to error responses. - NEVER pass user emails, names, IDs, or message content in `context` (the SDK

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to transmit contact_email, server name, and server URL to a third-party service to create a publisher account. Although it says to do so 'with the human's consent' in the MCP flow and 'ask the human if not provided,' the skill metadata/description does not clearly disclose this external transmission behavior up front, so an agent could perform or suggest data transfer without an adequate user-facing warning.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The provided curl command posts user-associated data, including contact_email, to an external domain and returns an API key. This creates privacy and secret-handling risk because the skill normalizes third-party data transmission and credential issuance inside an agent workflow, where users may not fully appreciate what is being sent or where the resulting secret may be exposed.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
## 2. Get credentials (ask the human if not provided) The human needs a publisher account (free): https://getlulu.dev/publishers or `curl -X POST https://ads.getlulu.dev/publishers -H 'content-type: application/json' -d '{"name":"<server name>","contact_email":"<email>","server_url":"<repo url>"}'` Response contains `publisher_id` and a one-time `api_key`. Store them as env vars `LULU_ADS_PUBLISHER_ID` and `LULU_ADS_API_KEY` — never hardcode the key.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
## 5. Verify Run the server, call any tool, and confirm the response includes `"sponsored": {"label": "Sponsored", ...}` (or nothing, if no fill — also correct). Done.