ClawHub
Back to skill

Security audit

ecommerce-video-ads

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious with medium confidence, mainly because its generation workflow may send user assets to an external service without clearly disclosing the transfer or getting approval.

Before installing, consider whether you are comfortable with the generation workflow’s external asset handling and with an unpinned installation CLI. The scan inspected all nine listed components, but coverage was partial because a local path-like reference in SKILL.md could not be resolved; the findings are therefore incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/questions.md (reported line 37)May include surrounding context.

md
## Testing

**8. How many creatives or hooks should I test, and when do I kill an ad?**
TikTok: 3–5 very different creatives per ad group. Meta: since Andromeda, ads that look alike or open the same way are grouped as one, so test 8–15 *different concepts* (buyer, angle, format), not one video with ten captions. Only 5–8% of ads become winners in Motion's 2026 data (578,750 creatives). Don't judge in the first 48 hours; judge after spending about 1–3× your target CPA. Once a concept wins, cut 3–5 new openers on its body. Sources: [TikTok creative best practices](https://ads.tiktok.com/help/article/creative-best-practices?lang=en), [Motion creative benchmarks 2026](https://runneth.com/library/research/creative-benchmarks-2026/top-visual-formats), [Meta on diversification](https://www.facebook.com/business/news/demystifying-creative-diversification). More: [How to make video ad variants for testing with AI](https://varg.ai/how-to/make-video-ad-variants-for-testing).

**9. Which format sh

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The installation example invokes an unpinned npm CLI through npx, allowing the package version executed during installation to change without review. A compromised release could execute code with the installing user's permissions; this is a supply-chain hardening issue, not evidence of malicious behavior or an unpinned MCP server.

Content

No source excerpt is available for this finding.

The generation workflow requires user-provided reference assets without warning that they will be sent to an external service.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow requires real product photos and reusable character references for generation through external services, but does not explicitly disclose the asset transfer or require approval of the specific assets sent. Although the varg dependency and generation-cost approval are disclosed, those safeguards do not establish informed consent to upload potentially confidential product imagery or personal likeness and voice assets.

Content

No source excerpt is available for this finding.