Security audit

Ad-Ready

Security checks across malware telemetry and agentic risk

Overview

This is a real ad-image generator, but it needs Review because it can send assets to an external service and tightly copy a person's likeness and protected traits without clear consent controls.

Review before installing. Use only public product URLs, avoid internal or private links, and provide model or reference images only when you have rights and consent for commercial ad use. Assume product images, logos, model photos, reference ads, brand choices, and briefs may be sent to ComfyDeploy and downstream AI services.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs the agent to use environment variables, write files under /tmp, inspect local directories, fetch remote content, and submit data to a third-party API, yet no permissions are declared. That mismatch weakens policy enforcement and user visibility, increasing the chance the agent performs network and file operations the user did not meaningfully authorize.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The top-level description presents the skill as a simple product-URL-to-ad generator, but the body grants broader behavior: uploading model/reference images, scraping and downloading third-party assets, logo retrieval, language and creative overrides, and potentially multiple outputs. This description-behavior gap can mislead users and orchestration layers about what data will be collected, what content may be cloned, and what external services will receive inputs.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The prompt instructs the model to generate an extensive identity blueprint for a referenced person, including facial structure, body details, age range, skin tone, and beauty positioning, which materially exceeds the skill’s stated purpose of creating product advertising images from a product URL and brand profile. This expands the system into sensitive person-attribute inference and identity profiling, increasing privacy, misuse, and policy risk without clear necessity for the advertised function.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The prompt requires exact replication of pose and style reference imagery, including body position, limb placement, and style characteristics, creating direct reference-copying behavior not disclosed in the skill manifest. This can enable unauthorized imitation of source images or creators’ work and increases legal and safety risk beyond ordinary inspiration-based ad generation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The prompt explicitly asks the model to describe ethnicity, skin tone, and perceived beauty level of a referenced person, which is a sensitive-attribute and attractiveness-classification capability not clearly required for generating a product ad. This creates risk of inappropriate profiling, biased outputs, and handling of sensitive personal characteristics without a justified business need.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The prompt explicitly requires exact preservation of a referenced talent’s facial features, ethnicity, body type, and even face-swapping prohibition, which enables identity-locked image generation beyond the skill’s stated purpose of product-url-based ad creation. In an advertising workflow, this materially increases the risk of unauthorized likeness replication, privacy violations, and deceptive endorsement-style creatives if users provide third-party reference images.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The prompt directs exact pose replication and close extraction of photography style and location characteristics from reference images, which supports cloning of protected creative expression rather than generating merely brand-aligned ads. This creates risk of copyright, trade dress, and misappropriation issues, especially when users submit third-party campaign imagery as references.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The module docstring states that logo and reference assets use a 'server-side bypass', but the implementation either uploads local files directly to ComfyDeploy or passes arbitrary remote URLs through unchanged. This mismatch is dangerous because operators may believe sensitive or restricted assets stay within a controlled server-side path when they are actually being sent to an external service, causing unintended data disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes scraping product pages, downloading images and logos, and transmitting inputs to a third-party ComfyDeploy endpoint without a clear privacy warning or user-consent step. In this context, URLs, product assets, brand materials, and optional reference/model images may contain proprietary or personal data, so silent transmission materially raises privacy and compliance risk.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: Mandating ethnicity description without user opt-in or documented necessity is a sensitive-person-data prompt pattern and is especially concerning because the skill is framed as product ad generation rather than demographic analysis. In this context, the skill becomes more dangerous because it normalizes extraction of protected traits from talent references as part of routine operation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The prompt explicitly instructs the system to preserve and describe the talent's ethnicity exactly from a reference image, removing user choice and making ethnicity a locked generation parameter. This is dangerous because it operationalizes a sensitive attribute for image generation and profiling, which can enable discriminatory targeting, exclusionary ad production, or inappropriate manipulation of protected characteristics in a marketing context.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The prompt explicitly locks the talent's ethnicity and requires exact preservation without any user opt-in, policy basis, or documented necessity. This creates a sensitive-attribute handling problem because the system is instructed to infer and preserve protected characteristics from an image, which can enable discriminatory or inappropriate identity-constrained generation workflows.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The JSON schema hard-codes 'ethnicity_and_skin_tone: Exactly as reference,' operationalizing preservation of protected traits as a required output field. Embedding this in the structured output makes the behavior systematic and easier to propagate across generations, increasing the risk of sensitive-attribute processing and biased downstream use.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The prompt is a powerful generation blueprint but contains no embedded activation constraints, authorization checks, or narrow trigger conditions, so it could be invoked in contexts beyond the intended retention-stage ad workflow. In a system that routes skills automatically, this ambiguity can cause misapplication of product/talent-preserving instructions and externalized campaign inputs, increasing the chance of unsafe or policy-incompatible content generation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The prompt explicitly locks talent ethnicity and facial traits to a reference image, removing user choice and creating a hard constraint on a protected attribute. In an ad-generation workflow, this can enable discriminatory casting replication, exclusionary targeting, or unauthorized demographic cloning from reference media, especially when the system is used at scale.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The output schema repeats the requirement for exact ethnicity and skin-tone matching, operationalizing a protected-attribute constraint as a mandatory generation parameter. Embedding this in structured output makes the behavior systematic and easier to automate across campaigns, increasing the risk of discriminatory ad production and sensitive-attribute processing without safeguards.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The prompt explicitly instructs the model to preserve and describe a person's ethnicity and skin tone exactly from a reference image, making protected-attribute inference and enforced identity replication part of the generation pipeline. In an ad-generation skill, this creates risk of biometric/person-attribute processing without explicit necessity, user choice, or policy guardrails, and could enable discriminatory or non-consensual use of likeness-sensitive traits.

External Transmission

Medium

Category: Data Exfiltration
Content: ## API Details **Endpoint:** `https://api.comfydeploy.com/api/run/deployment/queue` **Deployment ID:** `e37318e6-ef21-4aab-bc90-8fb29624cd15` ### ComfyDeploy Input Variables
Confidence: 87% confidence
Finding: https://api.comfydeploy.com/

External Transmission

Medium

Category: Data Exfiltration
Content: sys.stderr.reconfigure(line_buffering=True) DEPLOYMENT_ID = "e37318e6-ef21-4aab-bc90-8fb29624cd15" API_BASE = "https://api.comfydeploy.com/api" # Dynamic brand profiles from catalog BRANDS_DIR = Path.home() / "clawd" / "ad-ready" / "configs" / "Brands"
Confidence: 92% confidence
Finding: https://api.comfydeploy.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.