Ai Intelligent Ad Optimization

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 1.0.3

Overview

This skill is an ad-optimization description that asks users to clone and run mutable remote code that is not included in the reviewed package.

Review the external GitHub repository and its dependencies before installing. Use an isolated environment, avoid giving it advertising account credentials or budget-changing access until its code is pinned and reviewed, and require explicit approval for any bidding, targeting, or budget changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:43

Finding

Unpinned Remote Repository and Dependency Retrieval Followed by Local Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–46
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-ad-optimization
cd ai-intelligent-ad-optimization
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone a mutable external Git repository without pinning a commit hash or verifying a signed release. They then install dependencies from an unaudited requirements.txt and execute an unaudited app.py.

The audited project contains only SKILL.md; neither requirements.txt nor app.py is included. Consequently, the code ultimately installed and executed is outside the reviewed artifact and can change after this audit. In addition, Python package installation can execute package build or installation hooks, meaning code execution may occur during pip install before app.py is explicitly launched.

This primarily constitutes T03: Remote Payload Retrieval and Execution because the effective executable payload is fetched from a mutable external location. It also constitutes T08: Insecure Dependencies because dependency versions, sources, and cryptographic hashes are not available or verified in the audited artifact.

Attack Path

1. An attacker compromises the referenced GitHub repository, an upstream maintainer account, or a dependency referenced by its unavailable requirements.txt.
2. The attacker modifies app.py, the dependency manifest, or a dependency package to contain malicious code.
3. A user follows the documented installation procedure and clones the current repository state without a verified commit or release pin.
4. pip install -r requirements.txt installs attacker-controlled dependencies and may execute malicious package installation or build hooks.
5. The user runs python app.py, directly executing the ...[truncated 910 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the actual application source and dependency manifest in the skill package so they can be reviewed together.
2. Replace the mutable repository clone with a verified, immutable commit or signed release. Check the downloaded revision against an expected commit hash before installation.
3. Pin all Python dependencies to exact versions and cryptographic hashes, such as through a lock file and pip install --require-hashes.
4. Permit dependency retrieval only from explicitly trusted package indexes and disable unintended fallback indexes to reduce dependency-confusion risk.
5. Verify release signatures, package provenance, and integrity before executing any retrieved content.
6. Install dependencies in an isolated virtual environment or container and run the application as a dedicated, non-privileged user.
7. Restrict filesystem, credential, and network access to the minimum required for the advertised advertising-optimization functionality.
8. Review the pinned app.py, dependency manifests, transitive dependencies, and package installation hooks before recommending execution.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The name/description content presented to users is entirely in Chinese, and the file does not state that the skill is China-specific or that users may choose another language. This can violate language/locale policy when a skill implicitly enforces a language without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and feature list are broad marketing-style statements without clear invocation boundaries, user-consent conditions, or operational constraints. In an agent environment, this can cause overbroad activation or misuse for ad-spend, targeting, or optimization decisions beyond what the user explicitly requested, increasing the chance of unintended autonomous behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.