Security audit

Fullrun

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its Google Ads management purpose, but it can trigger automatic ad account changes through an unpinned global CLI using a sensitive API key.

Review this carefully before installing. Use only a verified `fullrun` package/version, avoid passing the API key on the command line, prefer a secret manager or safer login flow, and require manual approval before running automatic optimizations against live ad accounts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`, rather than resolving the latest release. - Document the official package publisher and authoritative source repository so users can verify package provenance. - Use a project-local dependency and lockfile instead of a global installation where practical. - Verify registry integrity metadata and package signatures or provenance attestations before installation. - Review package contents and lifecycle scripts for each approved version. - Disable lifecycle scripts during installation where compatible with the package, and run the CLI under a dedicated least-privilege account or isolated environment. - Establish an explicit upgrade process requiring review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:15
Finding: API Key Exposed Through a Command-Line Argument
Content: View full analysis
``` ### Technical Analysis The documented login command instructs users to place the Fullrun API key directly in a command-line argument. Depending on the operating system, shell, and execution environment, command arguments may be exposed through shell history, process inspection interfaces, terminal transcripts, audit systems, CI/CD logs, or wrapper-tool telemetry. Although process-argument exposure can be brief, shell history and automation logs may preserve the credential after the command exits. Any local user, administrator, support operator, or log consumer with access to those records could retrieve the key. The adjacent environment-variable alternative reduces direct argument exposure but should also be handled carefully because environment variables may be visible to authorized process-inspection tools or inadvertently logged. ### Attack Path 1. A user substitutes a real API key into `fullrun login ` and executes the command. 2. The shell records the complete command in its history, or an automation, terminal, audit, or monitoring system captures the process arguments. 3. An attacker or unauthorized operator obtains read access to the history file, process information, session transcript, or collected logs. 4. The attacker extracts the API key. 5. The attacker supplies the stolen credential to the relevant Fullrun client or API. 6. Subject to the key's assigned permissions and server-side controls, the attacker reads advertising information or initiates unauthorized campaign-management operations. ### Impact Assessment Disclosure of the API key could allow impersonation of the credential owner within the Fullrun service. The potential scope includes access to campaign health and performance data and, ...[truncated 436 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
- Respect guardrail errors (exit code 2) — they protect the ad account from harmful changes - Never call `fullrun run` repeatedly — check triage first to see if action is needed - Don't increase daily budget more than 20% in one action - Don't pause campaigns without checking conversion data first

Static analysis

No suspicious patterns detected.