Ecommerce Ppc Strategy Planner

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:03 PM UTC
• Version: 0.1.0

Overview

This is a disclosed PPC planning skill that asks for business ad metrics and produces strategy guidance, with the main caveat that its install examples use unpinned global skill installation commands.

Before installing, consider using a pinned CLI version and a reviewed commit or release for the skill repository if available, and avoid global installation unless you want the skill available across sessions. Share only the business metrics needed for the planning task, since margins, budgets, and campaign performance are commercially sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Remote Skill Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14 and 522
Vulnerability Type: Unpinned remote dependencies installed with global scope
Risk Level: Medium

Complete Code Snippets

At line 14:

bash

npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-ppc-strategy-planner -g

At line 522:

bash

npx skills add nexscope-ai/Amazon-Skills --skill amazon-ppc-campaign -g

Technical Analysis

The documented commands use npx without pinning the CLI package to a specific version and install Skill content from mutable remote repositories. Neither command identifies a reviewed commit hash, immutable release, checksum, or cryptographic signature.

The -g option requests global installation, increasing the scope and lifetime of any compromised content. The content retrieved when a user runs either command may therefore differ from the content that was reviewed during this audit.

This is a supply-chain weakness rather than evidence that the currently audited file contains a malicious payload. Exploitation depends on compromise or malicious modification of an upstream npm package, repository, release process, or maintainer account.

Attack Path

1. An attacker compromises the unpinned skills package, one of the referenced repositories, or an associated maintainer account.
2. The attacker publishes or commits modified Skill content containing malicious instructions or executable components.
3. A user follows the installation command from SKILL.md.
4. npx and the Skill installer retrieve the current remote versions instead of a previously reviewed immutable version.
5. The altered Skill is installed globally.
6. The malicious content can affect subsequent Agent sessions in which the installed Skill is loaded or invoked.

Impact Assessment

Successful exploitation could install attacker-controlled Skill content with global user-level scope. Depending on the capabilities of the upstream installer and the conte ...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an explicitly reviewed version rather than invoking an unversioned package through npx.
2. Pin each remote Skill repository to an immutable Git commit or signed release tag.
3. Publish and verify cryptographic checksums or signatures for all retrieved files before installation.
4. Remove -g unless global installation is strictly required; prefer a project-local or otherwise isolated installation.
5. Review the complete dependency tree and remotely retrieved Skill content before installation.
6. Use a lockfile or equivalent manifest that records exact package and repository revisions.
7. Execute installation in a least-privileged sandbox without credentials or sensitive filesystem access.
8. Document the expected files and hashes so users can detect unexpected upstream changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses npx skills without pinning a specific package version, so users may execute whatever version is current at install time. If the upstream package is compromised or a breaking/malicious release is published, running the command could execute attacker-controlled code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This command again instructs users to run npx skills without a pinned version when installing another skill. That creates the same supply-chain risk: the executed code can change over time and could be malicious if the referenced package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.