Ad Creative Engine

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:05 AM UTC
• Version: 1.0.0

Overview

The skill is a local video-ad rendering guide with disclosed media dependencies, but the package is incomplete and its Python dependencies are not pinned.

Install only in an isolated virtual environment or container, review or create a pinned requirements file before installing dependencies, and treat the current package as incomplete because the renderer and referenced assets are missing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned and Unverifiable Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–14; related installation instructions at lines 26–30 and 61–65
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

requires:
  bins:
    - python3
    - ffmpeg
  pip:
    - moviepy
    - pillow
    - librosa (optional, for beat_sync)

bash

cd skill-ad-creative-engine
pip3 install -r requirements.txt

python3 scripts/render.py --config examples/config_example.json

bash

pip3 install -r requirements.txt

Technical Analysis

The Skill declares the third-party Python packages moviepy, pillow, and librosa without exact versions, integrity hashes, or an approved package source. A Skill manager that interprets the requires.pip metadata may consequently resolve mutable package releases from its configured package index.

The documentation also instructs users to install dependencies from requirements.txt, but that file is absent from the audited project. No lockfile or equivalent dependency manifest is included. The package contents therefore provide no way to verify the intended versions, transitive dependency graph, or artifact integrity. The entry librosa (optional, for beat_sync) also mixes explanatory text with a package declaration and may be misinterpreted by automated dependency tooling.

The referenced scripts/render.py is likewise absent, so the advertised runtime behavior cannot be verified from the supplied project. As packaged, the documented commands are expected to fail due to missing files; however, automated installation based directly on the metadata could still attempt to resolve the declared dependencies.

Attack Path

1. A user or Skill manager installs the Skill and processes its requires.pip metadata.
2. The installer requests packages without enforcing exact versions or artifact hashes.
3. The configured package index supplies the c ...[truncated 1013 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the referenced requirements.txt, scripts/render.py, example configuration, fonts, and other required assets in the package so the complete implementation can be audited.
2. Pin every direct dependency to a reviewed exact version, and constrain or lock transitive dependencies using a reproducible lockfile.
3. Record cryptographic hashes for all artifacts and install with hash verification, such as pip install --require-hashes -r requirements.txt.
4. Configure an explicit trusted package index rather than relying on an unspecified environment-level source.
5. Separate optional dependency metadata from the package name. For example, define librosa in a valid optional dependency group instead of using librosa (optional, for beat_sync).
6. Perform dependency vulnerability and provenance scanning in continuous integration, and update locked versions through a reviewed process.
7. Install and run the Skill in an isolated, least-privileged virtual environment or container without unnecessary credentials or filesystem access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.