EMAR adv-plan-diagnosis

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:06 AM UTC
• Version: 1.0.2

Overview

This skill coherently diagnoses user-specified ad plans through the relevant ad-platform APIs, but users should handle the required access tokens carefully.

Install only if you are comfortable letting the script query the specified ad accounts using locally configured Ocean Engine or Tencent Ads tokens. Keep .env private, use least-privileged and short-lived tokens where possible, avoid logging full request URLs, verify account and ad IDs before running, and consider pinning dependency versions in managed environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (8)

Tainted flow: 'params' from os.getenv (line 101, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

'page': 1,
        'page_size': 10
    }
    resp = requests.get(url, params=params)
    resp.raise_for_status()
    data = resp.json()
    if data.get('code') != 0:

• Confidence: 90% confidence
• Finding: The Tencent Ads access token is placed in the URL query parameters of a GET request, which increases the chance of credential leakage via logs, proxies, browser history equivalents, monitoring systems, or upstream infrastructure that records URLs. Although the destination is the legitimate Tencent API, transmitting secrets in the query string is an unsafe pattern and can expose long-lived credentials.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad, natural-language requests such as '检查广告' and '成本高怎么办', which can cause accidental invocation in unrelated conversations. Unintended activation can expose internal workflow behavior, prompt for account identifiers, or initiate sensitive diagnostic actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs that access tokens are read from a .env file, but provides no user-facing safeguards on secret handling, storage boundaries, redaction, or non-disclosure. In an agent setting, encouraging implicit use of locally stored credentials increases the risk of secret exposure, misuse of privileged API access, or unsafe execution patterns around sensitive configuration.

Credential Access

High

• Category: Privilege Escalation

Content

巨量引擎使用官方诊断接口；腾讯广告因官方诊断接口下线，使用报表+规则引擎。

两个平台的 access_token 都从 .env 文件读取，需要用户自行配置并定期更新（腾讯 token 有效期2小时）。

若脚本返回 {"status": "error"}，将 message 告知用户。

• Confidence: 93% confidence
• Finding: The skill directs execution of a script that uses access tokens loaded from a .env file to call advertising platform APIs. Even though reading local secrets can be legitimate, exposing this pattern inside a skill materially increases the chance that the agent or surrounding tooling will access credentials beyond the user's explicit consent boundary, leading to credential misuse or leakage through logs, errors, or prompt injection chains.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any future version and makes builds non-reproducible. This increases supply-chain risk because a later compromised, incompatible, or vulnerable release could be pulled in without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: The package is not pinned to an exact reviewed version, so installs may resolve to different releases over time. That weakens reproducibility and can expose consumers to newly introduced vulnerabilities or malicious upstream releases.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The file allows use of requests versions at or above 2.25.0, and the advisory list indicates multiple vulnerable releases exist in that range. Without an upper bound or exact pin to a fixed version, dependency resolution may select a version affected by credential leakage, TLS/verification issues, or other published flaws.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: The requirement permits installation of python-dotenv versions that may include the cited file-overwrite issue if the package is used in affected code paths. While the impact depends on whether set_key and attacker-controlled symlinks are involved, the dependency declaration does not exclude vulnerable versions.

Static analysis

No suspicious patterns detected.