ClawHub
Back to skill

Security audit

ad2

Security checks for vulnerabilities and agentic risk

Overview

This ads-management skill is useful for its stated purpose, but it gives the agent broad automatic authority to call credential-backed ad tools, store competitor data, and approve or reject actions with too little user control.

Review this skill before installing in any account with real ad-spend authority or private campaign data. It should be narrowed to explicit ads commands, require confirmation before approve/reject or budget-affecting actions, allow truthful access-error reporting and clarification, sanitize URLs before external calls, and make competitor memory writes opt-in or clearly scoped.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:9
Finding

Mandatory Agent Instruction and Safety-Constraint Override

Content
View full analysis
` | `ads_manager_execute_action(proposalId:"", status:"approved")` | — | | `/tuchoi ` | `ads_manager_execute_action(proposalId:"", status:"rejected")` | — | | Any facebook.com URL | `meta_ad_library(pageUrl:"", country:"VN")` | `apify_facebook_ads(url:"")` | | "đối thủ [name]" | `serper_search(query:"site:facebook.com ")` | `meta_ad_library(pageUrl:"")` | | "sao ế / doanh số kém" | `ads_manager_brief(mode:"alerts")` | `ads_manager_brief(mode:"report")` | | "hôm nay làm gì" | `ads_manager_brief(mode:"plan")` | `ads_manager_brief(mode:"proposals")` | | "đăng bài / viết content" | use `fanpage-content-publisher` skill | — | | any performance question | `ads_manager_brief(mode:"report")` | — | ``` ```markdown ## ABSOLUTE RULE #4 — FORBIDDEN PHRASES You are PR ...[truncated 2839 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:42
Finding

Unconditional Credential-Backed Transmission of User Data to External Services

Content
View full analysis
", country:"VN")` | `apify_facebook_ads(url:"")` | | "đối thủ [name]" | `serper_search(query:"site:facebook.com ")` | `meta_ad_library(pageUrl:"")` | ``` ```markdown ## ABSOLUTE RULE #2 — APIFY TOKEN IS ALREADY CONFIGURED The system reads `APIFY_TOKEN` automatically from environment variables via `apify-service.ts` and `http-fetch.ts`. **You NEVER need to ask for an Apify token.** Just call `apify_facebook_ads(url: "")` directly. The same applies to: - `SERPER_API_KEY` → just call `serper_search(query: "...")` - `META_ACCESS_TOKEN` → just call `meta_ad_library(pageUrl: "...")` These tools handle auth internally. **Zero user input required.** ``` ```markdown ## ABSOLUTE RULE #3 — FALLBACK CHAIN (Never Give Up) When analyzing a competitor Facebook page: Step 1: meta_ad_library(pageUrl: "", country: "VN", limit: 20) → Got 3+ ads? → use results, go to Step 3 → Got 0-2 ads? → go to Step 2 Step 2: apify_facebook_ads(url: "", limit: 15) → Got results? → use results, go to Step 3 → Failed? → go to Step 2b Step 2b: serper_search(query: "site:facebook.com ads") → Use any found results Step 3: ads_manager_save_competitor(name, angle, note, sourceUrl) → ALWAYS save findings to memory Step 4: Analyze and respond using Competitor Report template ``` ```markdown ads_manager_brief → params: { mode: "report"|"overview"|"alerts"|"budget"|"plan"|"proposals"|"competitors" } ads_manager_create_proposal → params: { title, summary, reason, impact, campaignId?, commandHint? } ads_manager_execute_action → params: { proposalId, status: "approved"|"rejected" } ads_manager_save_c ...[truncated 3723 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The phrase 'any /command from boss' is ambiguous and underspecified, so the skill may claim authority over unrelated slash commands that belong to other workflows. In combination with mandatory tool execution, this ambiguity can cause unintended actions or tool calls from benign command usage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The command table authorizes direct execution of ads_manager_execute_action for /pheduyet and /tuchoi, while later documentation says actions must never execute directly and should always go through proposals first. This contradiction weakens safety guarantees and can enable immediate state-changing actions based on a chat command without sufficient validation or approval controls.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
minSpendForDecision: 300,000 VND

Rules:
  spend < minSpendForDecision → "watch" → insufficient data, do NOT judge
  learningPhase = true → "watch" → do NOT judge, do NOT recommend changes

  spend >= minSpendForDecision:

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
minSpendForDecision: 300,000 VND

Rules:
  spend < minSpendForDecision → "watch" → insufficient data, do NOT judge
  learningPhase = true → "watch" → do NOT judge, do NOT recommend changes

  spend >= minSpendForDecision:

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
→ Never judge individual placement/age/gender CPA

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The phrase 'any /command from boss' is ambiguous and underspecified, so the skill may claim authority over unrelated slash commands that belong to other workflows. In combination with mandatory tool execution, this ambiguity can cause unintended actions or tool calls from benign command usage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes and encourages use of a general-purpose http_request tool even though the documented business purpose is ads analysis and workflow orchestration. This unnecessarily expands network reach and could let prompt-triggered behavior access arbitrary URLs, exfiltrate data, or interact with internal services if the tool is available in sensitive environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The LANGUAGE RULES require 'Language: Vietnamese (unless boss writes English)' and 'Address boss as: "Sếp"', which imposes a language/locale preference by default rather than offering user choice. This is a natural-language policy concern because it forces a specific locale and honorific unless a narrow exception is met.

Content

No source excerpt is available for this finding.