Ads Optimizer Skill

• Analyzed: May 11, 2026, 4:56 AM
• Findings: 1
• Version: 1.0.1
• Hash: a95fb93ba8905f83455d740da34bfd4726c1d21d67e4628947e0395e1b0c63ac
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's core functionality aligns with its stated purpose of managing Amazon Ads. However, the `scripts/ads.js` file contains a critical arbitrary file write vulnerability. The `--out` command-line argument, intended for saving campaign data, directly uses the provided path in `fs.writeFileSync(args.out, ...)`. This lack of path sanitization allows an attacker or a malicious prompt to instruct the agent to write the script's JSON output to any arbitrary file path on the system, potentially leading to privilege escalation or system compromise. This is a significant vulnerability, classifying the skill as suspicious rather than malicious, as there is no clear evidence of intentional harmful behavior by the developer.