Security audit

Apple Ads

Security checks for vulnerabilities and agentic risk

Overview

This Apple Ads skill is coherent overall, but it needs review because some budget and bidding changes are documented as safe reads and the setup instructions execute remote installer scripts directly.

Review this before installing. Use a least-privileged Apple Ads/OOMOL account, require explicit confirmation before any apply or dismiss recommendation action, and prefer a verified oo CLI installation method instead of executing remote scripts directly. Treat all campaign, budget, bidding, recommendation, create, update, and delete operations as state-changing even if the skill text leaves them untagged.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:151
Finding: Unverified Remote Installation Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 151-155 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions retrieve mutable scripts from an external server and pass their contents directly to Bash or PowerShell. Neither command pins a version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded payload before execution. Although installation is conditional on the `oo` command being unavailable and the scripts come from the declared vendor domain, executing network responses directly in a shell is not the minimum privilege necessary to install a CLI. The effective code can change after the Skill has been reviewed. No evidence establishes that the current remote scripts are malicious. Nevertheless, compromise of the domain, hosting account, CDN, DNS resolution, TLS termination, or release pipeline could turn these documented commands into an arbitrary-code-execution channel. ### Attack Path 1. The `oo` CLI is absent, causing the agent or user to follow the first-time setup instructions. 2. The installation command requests a mutable script from `cli.oomol.com`. 3. An attacker who has compromised the relevant hosting or distribution infrastructure modifies the remote response. 4. `bash` or `iex` executes the response immediately without integrity verification. 5. The payload runs with the privileges of the user who invoked the installation command. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. Depending on that account's permissions and local configuration, this may expose accessible files, environment variables, authentica ...[truncated 362 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace direct remote-to-shell execution with installation from a trusted package manager or a pinned release artifact. 2. Download the installer to a local file without executing it: ```bash curl --fail --show-error --location --output install.sh \ https://example.invalid/releases/oo-cli/VERSION/install.sh ``` 3. Publish and verify a cryptographic checksum or signature before execution. 4. Pin an immutable version rather than using an unversioned `install.sh` or `install.ps1` endpoint. 5. Allow the user to inspect the downloaded artifact and require explicit approval before executing it. 6. Run installation with ordinary user privileges and avoid elevation unless a documented installation step strictly requires it. 7. Document the expected files, network destinations, and system changes made by the installer. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:39
Finding: State-Changing Apple Ads Actions Are Misclassified as Safe Reads<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39-40, 63-64, and 140-142 **Vulnerability Type**: Incorrect authorization and confirmation classification **Risk Level**: High ### Vulnerable Code ```text - `apply_daily_budget_recommendations` — Accept one or more daily budget recommendations. Apple Ads raises each campaign's daily budget and moves the recommendation to the terminal APPLIED state. - `apply_target_cpa_recommendations` — Accept one or more target CPA recommendations. Apple Ads changes the target the campaign's Maximize Conversions bidding optimizes toward and moves each recommendation to the terminal APPLIED state. ``` ```text - `dismiss_daily_budget_recommendations` — Reject one or more daily budget recommendations. Each campaign keeps its current daily budget, but the recommendation moves to the terminal DISMISSED state and never returns to AVAILABLE. - `dismiss_target_cpa_recommendations` — Reject one or more target CPA recommendations. The campaign keeps its current target, but each recommendation moves to the terminal DISMISSED state and never returns to AVAILABLE. ``` ```text - Untagged actions are reads (get / list / search) — safe to run directly. - **Actions tagged `[write]` change Apple Ads state — confirm the exact payload and effect with the user before running.** - **Actions tagged `[destructive]` remove or overwrite data — always confirm the target and get explicit approval first.** ``` ### Technical Analysis The four recommendation actions are untagged even though their descriptions explicitly state that they mutate Apple Ads state: - `apply_daily_budget_recommendations` raises campaign daily budgets. - `apply_target_cpa_recommendations` changes bidding targets. - Both dismissal actions permanently move recommendations into a terminal `DISMISSED` state. The Safety section declares every untagged action to be a read that is safe to execute directly. Consequently, an agent following these instructions may ...[truncated 1648 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Add `[write]` to all four state-changing actions: - `apply_daily_budget_recommendations` - `apply_target_cpa_recommendations` - `dismiss_daily_budget_recommendations` - `dismiss_target_cpa_recommendations` 2. Require explicit confirmation of: - The Apple Ads account and campaign identifiers. - Every affected recommendation. - The complete request payload. - Current and proposed budget or target CPA values. - Expected financial and operational effects. 3. For terminal dismissals, clearly state that the recommendation cannot return to `AVAILABLE`. 4. Replace the rule “untagged actions are reads” with a fail-closed rule: untagged or unknown actions must require confirmation. 5. Determine mutability from authoritative connector schema metadata where possible rather than relying exclusively on manually maintained Markdown tags. 6. Add automated validation that rejects documentation builds when an action with state-changing semantics lacks an appropriate safety classification. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The safety section says only `[write]` actions change state and untagged actions are safe to run directly, but `apply_daily_budget_recommendations` and `apply_target_cpa_recommendations` explicitly mutate campaign settings and permanently transition recommendations to APPLIED. That mismatch can cause an agent to execute budget/bidding changes without the confirmation normally required for state-changing operations.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: `get_budget_order` is described as a read operation but is tagged `[write]`, creating inconsistent semantics for tooling or agents that rely on tags to decide whether extra confirmation is needed. While this is safer than under-labeling a write, it can still break policy logic, produce needless friction, and reduce trust in the skill's action classification.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description says to use this skill for ANY Apple Ads request instead of calling the API directly, which is an overly broad trigger surface. Broad routing increases the chance the skill is invoked for tasks it is not the best fit for, including ambiguous or high-risk requests where stronger policy checks or narrower tools should apply.

Static analysis

No suspicious patterns detected.