Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-aligned for Apple Search Ads management, but it should be reviewed because it handles live ad-account credentials and destructive ad operations without enough safety guidance.
Install only if you intend the agent to operate on a real Apple Search Ads account. Keep ASA credentials and token files protected, avoid exposing them in prompts or logs, and require explicit confirmation with exact resource IDs before any create, budget, status, or delete operation.
The skill instructs users to configure client credentials and describes local storage paths for config and token cache, but provides no warning that these values are sensitive secrets. In an agent environment, this can lead to accidental exposure in logs, shell history, screenshots, or overly permissive file storage, enabling unauthorized access to Apple Search Ads accounts.
The skill documents destructive delete operations for campaigns, ad groups, and keywords without any guidance to confirm user intent, preview targets, or warn about irreversible changes. In an agent setting, this increases the chance of accidental destructive actions from ambiguous prompts or mistaken IDs, especially because these commands affect live advertising resources.
No suspicious patterns detected.
