Security audit

Ad-Ready Pro

Security checks for vulnerabilities and agentic risk

Overview

This ad-generation skill is coherent, but it needs review because it can fetch arbitrary product or image URLs and upload retrieved assets to ComfyDeploy without clear network-scope safeguards.

Review before installing or running this skill on sensitive products, internal URLs, private staging sites, unreleased brand assets, or confidential reference images. Use manually selected public assets where possible, avoid auto-fetch for untrusted URLs, and prefer running it in an environment with restricted outbound network access and a locked dependency set.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.py:148
Finding: Unrestricted Product and Image URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
bool: """Try to find and download the main product image from a product page.""" try: from bs4 import BeautifulSoup except ImportError: print(" ⚠ beautifulsoup4 not available for product image extraction", flush=True) return False print(" Fetching product page for main image...", flush=True) try: headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Accept": "text/html,*/*", } response = client.get(product_url, headers=headers, follow_redirects=True, timeout=20.0) if response.status_code != 200: print(f" ✗ Could not fetch product page ({response.status_code})", flush=True) return False soup = BeautifulSoup(response.text, "html.parser") # Strategy 1: og:image meta tag (most reliable) og_img = soup.find("meta", property="og:image") if og_img and og_img.get("content"): img_url = urljoin(product_url, og_img["content"]) print(f" Found og:image: {img_url[:80]}...", flush=True) if download_to_file(client, img_url, dest): return True # Strategy 2: Large images in the page images = soup.find_all("img") candidates = [] for img in images: src = img.get("src") or img.get("data-src") or img.get("data-lazy-src") if not src: continue src = urljoin(product_url, src) # Skip tiny images, icons, tracking pixels width = img.get("width", "0") height = img.get("height", "0") try: w = in ...[truncated 3826 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/generate.py:3
Finding: Unpinned Runtime Dependencies Permit Unreviewed Supply-Chain Changes
Content: View full analysis
=3.10" # dependencies = [ # "httpx>=0.25.0", # "beautifulsoup4>=4.12.0", # ] # /// ``` ### Technical Analysis The inline dependency declarations specify only minimum versions. They allow `uv run` to resolve and execute future compatible releases of `httpx`, `beautifulsoup4`, and their transitive dependencies. The audited project contains no lockfile or integrity hashes. Consequently, two executions of the same reviewed Skill can install different dependency code without any corresponding change to the Skill package. This weakens reproducibility and allows dependency updates to bypass the Skill's code-review boundary. The declarations do not demonstrate that the current packages are malicious. The risk arises because a future compromised package release, compromised transitive dependency, or otherwise unsafe update could be selected automatically and execute within the Skill process. ### Attack Path 1. A direct or transitive dependency publishes a compromised or malicious release that satisfies the declared minimum-version constraint. 2. The Skill is executed in an environment that does not already have a locked dependency set. 3. `uv run` resolves the newer, unreviewed release. 4. Package installation, import initialization, or invoked library functionality executes attacker-controlled code in the Skill process. 5. That code inherits access to the process environment, network connectivity, user-selected files, and the ComfyDeploy API key available to the process. ### Impact Assessment A compromised dependency would execute with the same operating-system privileges as the Skill. Depending on the execution environment, it could potentially: - Read environment variables, including `COMFY_DEPLOY_API_KEY`. ...[truncated 370 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs the agent to use network access, environment variables, and file writes, but it does not declare any tool scope or permission boundaries. That omission increases the chance of over-privileged execution and makes it harder to enforce least privilege or audit what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This invocation guidance is broad enough to match many ordinary requests involving product URLs and ad creation, but it does not define boundaries for when this skill should or should not be used versus alternatives. The file also does not provide negative examples or a narrowly scoped trigger context to reduce unintended activation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes automatically downloading images from third-party sites and uploading them to ComfyDeploy, but it does not clearly require user consent or warn about external data transfer. This can expose proprietary product assets, internal URLs, or user-supplied images to external services without informed approval.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: Transmission to an external API is expected for this skill, but it is still a real security concern because the skill sends user-derived content and downloaded assets to a third-party endpoint. In context this is less suspicious than covert exfiltration, yet it remains dangerous if users are not informed, if sensitive inputs are accepted, or if endpoint access is broader than necessary.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
## API Details **Endpoint:** `https://api.comfydeploy.com/api/run/deployment/queue` **Deployment ID:** `e37318e6-ef21-4aab-bc90-8fb29624cd15` ## ComfyDeploy Input Variables

External Transmission

Medium

Category: Data Exfiltration
Confidence: 85% confidence
Finding: The script transmits user-supplied product URLs and optional image assets to external services, including ComfyDeploy and logo/image sources. In this skill context that behavior is expected, but it still creates a real data-exfiltration boundary: sensitive or internal URLs, local files, and brand assets may be uploaded or fetched over the network without restriction, and auto-fetch can be abused to probe internal resources if untrusted URLs are accepted.
Content: Scanner excerpt · scripts/generate.py (reported line 45)May include surrounding context.
python
sys.stderr.reconfigure(line_buffering=True) DEPLOYMENT_ID = "e37318e6-ef21-4aab-bc90-8fb29624cd15" API_BASE = "https://api.comfydeploy.com/api" # Dynamic brand profiles from catalog BRANDS_DIR = Path.home() / "clawd" / "ad-ready" / "configs" / "Brands"

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script uses Spanish variable names and API input keys such as "producto", "referencia", and "marca", which surface in the skill’s behavior and can encode a fixed locale convention. There is no indication that users can choose language or that this locale constraint is documented as intentional or region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.