T03 · Remote Payload Retrieval and Execution
Error
- Location
references/generative-tools.md:414- Finding
Unpinned Remote Repository Setup Executes Mutable Third-Party Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Ad Creative
Security checks for vulnerabilities and agentic risk
Overview
This ad-writing skill is mostly coherent, but it also points agents toward ad-account changes and unpinned third-party code execution without enough user-control guidance.
Use this skill mainly for drafting and reviewing ad creative. Before allowing it to connect to ad accounts, upload assets, create campaigns, run npx/git/make commands, clone voices, or use named prospect data, require explicit confirmation, pin tool versions or reviewed commits, and verify rights, consent, privacy, and platform-policy compliance.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/generative-tools.md:563- Finding
Use of Mutable npm Packages Through npx Allows Post-Audit Code Substitution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## Common Mistakes - **Writing headlines that only work together** — RSA headlines get combined randomly - **Ignoring character limits** — Platforms truncate without warning - **All variations sound the same** — Vary angles, not just word choice - **No CTA headlines** — RSAs need action-oriented headlines to drive clicks; include at least 2-3 - **Generic descriptions** — "Learn more about our solution" wastes the slot
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation description includes broad phrases such as 'write me some ads' and 'generate'/'iterate' ad creative, plus 'Use this whenever someone needs to produce ad copy at scale,' without clear exclusion conditions. In a markdown skill file, this can cause unintended invocation for ordinary brainstorming or generic writing requests that may belong to other skills.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill’s stated purpose is ad creative generation, but this section broadens scope into pulling performance data and managing campaigns via external tools. That creates capability creep: an invocation intended for copywriting could lead an agent to access ad account data or perform operational ad actions beyond user expectations, increasing the risk of unauthorized or overly broad actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Including campaign creation capabilities in an ad-creative skill is not aligned with its declared function and can cause an agent to invoke tools that modify advertising assets rather than just draft copy. If exploited or mis-triggered, this could result in unintended campaign creation, spend exposure, or account changes without sufficiently explicit user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document explicitly recommends brand voice cloning and lists cloning vendors but provides no warning about consent, rights, or impersonation misuse. In an ad-creative skill, that omission increases the likelihood of unauthorized cloning of spokespersons, employees, or third parties, creating legal, privacy, and abuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The personalized video guidance encourages use of names and data in generated ads without any warning about lawful collection, minimization, or safe handling of personal data. In ad operations, this can lead users to process personal identifiers in third-party tools without considering privacy obligations or data-sharing risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API example:
bash # Using the Gemini API for image generation curl -X POST "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:generateContent" \ -H "Content-Type: application/json" \ -H "x-goog-api-key: $GEMINI_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API example:
bash curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" \ -H "xi-api-key: $ELEVENLABS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API example:
bash curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}" \ -H "xi-api-key: $ELEVENLABS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The cold-outreach personalization example promotes named prospect videos without any caution around privacy, consent, or anti-spam obligations. Because this is framed as a concrete use case, it materially increases the chance that users will deploy individualized outreach based on scraped or non-consensual data.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.