投放Agent自动化体验测试

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.0

Overview

This skill is a real UX automation workflow, but it asks for live session cookies and can trigger changes in advertising accounts without clear safeguards.

Install only if you can run it against a dedicated test advertising account with no production spend. Do not paste full browser cookies into chat or shared files; use a local-only login flow or short-lived, least-privileged test credentials instead. Remove or disable budget changes, bulk pause commands, and one-click execution tests unless each action is manually approved and reversible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The documented workflow goes beyond passive UX observation and explicitly includes live operational actions like adjusting budgets, pausing ads, and executing optimization actions. In a production advertising account, these steps can directly alter campaign state, spend, delivery, and business outcomes, making the skill dangerous even if framed as 'testing.'

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill contains instructions to perform real campaign-control behaviors unrelated to merely evaluating interface usability, including budget changes, bulk pausing, and one-click execution of platform actions. Those capabilities materially expand risk because the agent could be used to manipulate active ad operations under the guise of product evaluation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script issues live natural-language commands such as budget changes, pausing ads, and querying account performance through an authenticated browser session. In the context of a real ad account, these are not passive UX checks: they can trigger account state changes, spend changes, or operational disruption if the agent executes them rather than merely previewing them.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The script goes beyond observing UI presence and navigates into the '妙招' workflow, including discovery of '一键执行' controls for bulk actions like creative cleanup and ad shutdown. Even though it does not click the execution button here, exercising operational automation surfaces dangerous capabilities in a production-authenticated context and increases the chance of accidental triggering or later extension into destructive execution.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill instructs the user to extract full browser cookies and send them to the agent, including authentication tokens for ad.qq.com, woa.com, and qq.com. These cookies are effectively bearer credentials; exposure can enable session hijacking, unauthorized account access, and lateral access to internal or linked services depending on token scope.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill documents destructive platform actions such as changing budgets, pausing ads, and triggering 'one-click execute' without warning that these steps may modify real account state. In the context of an ad platform, such actions can immediately affect spend, pacing, lead volume, and campaign continuity, so the lack of warnings and safeguards materially increases risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The guide explicitly instructs users to extract `document.cookie` from an authenticated ad.qq.com session and send the full value elsewhere, which exposes live session credentials. In this skill’s context, those cookies are intended to grant access to an advertising account and agent features, so disclosure could enable account takeover, unauthorized actions, or access to sensitive business data.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The script loads authenticated cookies from disk and injects them into a browser context, which means a highly sensitive session token is handled as a local file artifact. If that file is exposed through weak filesystem permissions, logs, repository commits, or shared environments, an attacker could reuse the session to access the advertiser account.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Directing an operator to run document.cookie in a logged-in browser and paste the result into the agent exposes highly sensitive session material in plain text. Because these cookies represent active authenticated sessions, anyone with access to the conversation or logs may reuse them to impersonate the user and access advertising or related services.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions walk the user through opening developer tools, reading `document.cookie`, and transmitting the complete authenticated cookie string in plain language. That is effectively a request for reusable authentication material, and because the skill is specifically designed around 'Cookie注入' for automated access to the ad platform, the surrounding context makes the exposure more dangerous rather than less.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The FAQ further normalizes insecure handling by advising users to split or save the full cookie string for later transmission if it is too long. This increases the chance of accidental leakage, persistence in logs or files, and reuse by anyone who gains access to the transmitted or stored cookie data.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.