Security audit

广告投放优化

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed cloud-based advertising optimization helper, with no evidence of hidden account changes, persistence, or destructive behavior.

Before installing, understand that ad metrics, campaign context, and your TOKENAPI_KEY are used with Yufluent’s cloud service. Consider pinning dependencies in controlled environments, and review any sensitive business metrics before sending them to the provider.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which makes installs non-reproducible and can pull in different versions over time. This increases supply-chain risk and can unexpectedly introduce vulnerable or breaking releases depending on when and where the skill is installed.

Static analysis

No suspicious patterns detected.