ClawHub
Back to skill

Security audit

Ad Creative

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an ad-creative helper, but it includes under-scoped campaign-management and copy-paste remote execution guidance that users should review before installing.

Install only if you are comfortable with a skill that may guide agents beyond copywriting into ad-account workflows, generative media APIs, voice cloning, and local development commands. Require explicit confirmation before any campaign upload or campaign creation, use consented/licensed voices only, and pin or inspect any third-party packages or repositories before running the documented commands.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
references/generative-tools.md:416
Finding

Unpinned Voicebox Repository Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: references/generative-tools.md, lines 416-417
Vulnerability Type: Remote third-party code retrieval and execution without immutable version pinning
Risk Level: Medium

bash
git clone https://github.com/jamiepine/voicebox.git
cd voicebox && make setup && make dev

Technical Analysis

The documented workflow clones the current state of a third-party repository and immediately invokes repository-controlled Make targets. The source is not pinned to a reviewed commit hash or signed release, and the instructions do not require checksum or signature verification.

make setup and make dev execute commands defined by the downloaded repository. Consequently, the code executed by a user can change after this Skill has been reviewed. If the upstream repository, maintainer account, build files, or dependency chain is compromised, the Make targets could execute attacker-controlled commands with the privileges of the invoking user.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or a dependency used by its setup process.
  2. The attacker modifies a Make target or related setup file to include a malicious command.
  3. A user follows the documented instructions and clones the mutable default branch.
  4. The user runs make setup or make dev.
  5. The malicious command executes locally under the user's account.

Impact Assessment

Successful exploitation could provide arbitrary command execution with the invoking user's privileges. Depending on the user's permissions and environment, the attacker could read or modify accessible project files, source code, environment variables, API credentials, and user-owned configuration files. The attacker could also initiate network connections or modify local development artifacts. This instruction does not itself grant elevated system privileges, so the direct scope is limited ...[truncated 50 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a reviewed, immutable commit hash or a cryptographically signed release tag.
  • Provide the expected archive checksum and require users to verify it before executing setup commands.
  • Separate retrieval from execution so users can inspect the repository, Makefile, and installation scripts first.
  • Document the dependencies and commands executed by make setup and make dev.
  • Recommend running the setup in an isolated container or low-privilege development environment without production credentials.
  • Establish a controlled process for reviewing and updating the pinned revision.

T08 · Insecure Dependencies

Warning
Location
references/generative-tools.md:563
Finding

Execution of an Unpinned Latest npm Package Version

Content
View full analysis

Vulnerability Details

File Location: references/generative-tools.md, line 563
Vulnerability Type: Unpinned executable dependency retrieved from npm
Risk Level: Medium

bash
# Create a new Remotion project
npx create-video@latest

Technical Analysis

The command instructs npx to resolve, download, and execute the package version currently associated with the mutable latest distribution tag. The effective executable payload can therefore change without any modification to this Skill.

No exact package version, lockfile, integrity value, provenance verification, or lifecycle-script review is required. If the package, publisher account, npm distribution tag, or relevant dependency chain is compromised, a malicious release could execute arbitrary code when a user runs the command.

Attack Path

  1. An attacker compromises the npm package, publisher credentials, distribution tag, or an installation dependency.
  2. A malicious package version is published or assigned to the latest tag.
  3. A user follows the documented command.
  4. npx retrieves the attacker-controlled package version and executes its entry point and any applicable package scripts.
  5. The payload runs with the privileges and environment access of the invoking user.

Impact Assessment

Successful exploitation could result in arbitrary command execution under the invoking user's account. The malicious package could access readable source files, project configuration, environment variables, package-manager credentials, and other user-accessible data. It could modify the generated project or other writable files and communicate with external systems. The command does not inherently elevate privileges; impact is bounded by the user's existing permissions and the isolation controls of the execution environment.

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Commit and enforce a package lockfile containing integrity hashes.
  • Verify npm package provenance, publisher identity, and release metadata before approving upgrades.
  • Review package lifecycle scripts and the executable entry point before use.
  • Prefer installation from an organization-controlled registry or approved dependency mirror where available.
  • Run scaffolding commands in an isolated, least-privilege environment without sensitive credentials.
  • Use an explicit dependency-update process that reviews and tests each version before changing the pinned command.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md
## Common Mistakes

- **Writing headlines that only work together** — RSA headlines get combined randomly
- **Ignoring character limits** — Platforms truncate without warning
- **All variations sound the same** — Vary angles, not just word choice
- **No CTA headlines** — RSAs need action-oriented headlines to drive clicks; include at least 2-3
- **Generic descriptions** — "Learn more about our solution" wastes the slot

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is very broad and overlaps with many ordinary writing requests, increasing the chance this skill is auto-selected in contexts where a more constrained general writing or copywriting skill would be safer. Overbroad activation can expose users to unnecessary tool references and expanded behaviors not needed for the task.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill materially expands from ad-copy generation into image/video production workflows and operational guidance for scaled creative production. This broadens the capability surface beyond the declared purpose, making it easier for the agent to drift into adjacent execution tasks and invoke external tooling or workflows the user did not explicitly request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The tool integration section references pulling performance data and managing campaigns, including campaign creation/listing commands, which exceeds the scope of an ad-creative writing skill. In an agent setting, this can encourage unintended operational actions on ad accounts rather than staying in an analysis/content-generation role.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Including campaign management capabilities in a skill focused on generating ad creative violates least privilege and creates an unnecessary path from content generation to account-level ad operations. If misused or auto-invoked, this could result in unauthorized campaign changes, spend, or deployment actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The eval explicitly rewards triggering on casual phrasing, which can broaden activation boundaries beyond clear user intent. In a skill-routing system, this increases the chance the ad-creative skill is invoked for loosely related requests, causing misrouting, overreach into adjacent domains, or failure to defer to more appropriate skills such as strategy-focused workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/generative-tools.md (reported line 50)May include surrounding context.

API example:

bash
# Using the Gemini API for image generation
curl -X POST "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:generateContent" \
  -H "Content-Type: application/json" \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file promotes voice cloning for ad production but omits any warning about obtaining explicit consent, avoiding impersonation, and complying with platform, privacy, and publicity-rights requirements. In an ad-creative context, this increases the chance of deceptive or unauthorized cloning of a real person's voice for commercial use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/generative-tools.md (reported line 322)May include surrounding context.

API example:

bash
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/generative-tools.md (reported line 322)May include surrounding context.

API example:

bash
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documentation instructs users to execute an unpinned npx create-video@latest-style package invocation, which fetches and runs code from the registry at execution time. If the upstream package is compromised, replaced, or changes behavior, users may execute unintended code on their machines or CI systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

npx remotion render without a pinned package/version can cause users to download and execute whatever package version is current at the time of use. In a developer workflow skill, this is materially risky because CI runners and local environments may run unreviewed code from npm.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This command repeats the same unsafe pattern of executing an unpinned npm package through npx, creating a supply-chain and arbitrary-code-execution risk if the package or one of its dependencies is compromised. The risk is amplified because the skill presents it as a copy-pasteable workflow step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.