ClawHub
Back to skill

Security audit

Ppc Campaign Strategist

Security checks for vulnerabilities and agentic risk

Overview

This PPC strategy skill is coherent but asks the agent to use live ad account data and make campaign or budget changes without clear confirmation safeguards.

Install only if you are comfortable with a PPC agent that may use connected ad-platform APIs. Before allowing write access, require explicit confirmation for campaign creation, budget changes, bidding changes, and keyword deployments, and prefer read-only API access unless you are intentionally executing a reviewed change plan.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs the agent to execute structural changes directly in a live advertising account, including campaign creation, bid strategy adjustments, budget reallocations, and negative keyword deployment, without requiring user confirmation or preview. In a PPC environment, these actions can immediately spend money, suppress traffic, or alter bidding behavior at scale, making accidental or unauthorized changes financially significant.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
78% confidence
Finding

The instruction to 'always prefer live API data' pushes the agent toward connected systems and away from safer offline review, which can bias behavior toward tool use and live-account interaction even when unnecessary. In context, this is more dangerous because the same skill also promotes direct execution of account changes, increasing the chance that recommendations and actions occur against production advertising assets without adequate human gating.

Content

Scanner excerpt · AGENTS.md (reported line 38)May include surrounding context.

md
* **Execute structural changes** directly — campaign creation, bid strategy adjustments, budget reallocation, and negative keyword deployment without leaving the AI workflow
* **Automate recurring analysis** — scheduled performance pulls, automated anomaly detection, and account health scoring at MCC scale

Always prefer live API data over manual exports or screenshots. If a Google Ads API connection is available, pull account_summary, list_campaigns, and auction_insights as the baseline before any strategic recommendation.

## Decision Framework

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation instruction says to use the agent 'by name or specialty when you need its expertise,' which does not define specific trigger phrases or clear boundaries for when the skill should activate. The phrase 'specialty' and the condition 'when you need its expertise' are broad enough to overlap with many ordinary requests about advertising or strategy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.