Versioned security assessment

Report ID: SA-D71C7417

7/12/2026, 10:37:55 AM

ad-creative-builder security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ad-creative-builder
Version
v3
Maintainer
aaron-he-zhu
Source
github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/ad/orchestrate/ad-creative-builder
Coverage
3 Files scanned · 178 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Twenty-nine static findings are Markdown formatting, metadata URLs, or documentation links without command execution or unsafe path access. One high-severity finding is confirmed because the save instruction places a user-controlled offer value into a filename without requiring sanitization. Semantic review also found that the workflow fetches a user-supplied destination URL without requiring protections against internal network access.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 178 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 12 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 15 evidence locations

Capability review items (1)
High
SKILL.md:72
Path traversal sequence
On user confirmation, save to `memory/ad/ad-creative-builder/YYYY-MM-DD-<offer>.md` with the depende
Line 72 places the user-supplied offer value directly into a save filename without requiring sanitization. An offer containing path separators could escape the intended memory directory unless the host enforces containment.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
SKILL.md:57-58
Unvalidated Destination URL Fetch
The workflow requires reading a user-supplied destination URL without scheme, address, redirect, or host validation. A crafted URL could trigger an SSRF-style request from a capable agent host.
Lines 57-58 explicitly accept and read the destination URL, while the skill defines no network destination controls. Host-level protections may reduce exploitability.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    The save filename includes the user-controlled offer value without defined sanitization.
    Convert the offer to a restricted filename slug, reject path separators, resolve the final path, and verify it remains inside memory/ad/ad-creative-builder.
  2. FIX-002
    High
    The destination-page workflow accepts a user-supplied URL without network destination validation.
    Allow only HTTP and HTTPS, block private and link-local addresses, validate redirects and DNS results, and require approval for unexpected hosts.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
d71c7417a35d5c2624161bd2fe8de8a41a362128
Content hash
ad6cb4b047b6ee075490f21898c9d0a154b3f12439881eaef4291452665cccd1
Tree hash
171b6d6d9618cccce360defd967ae44a661197d3c6105471b76564264fec607e
Skill path
skills/aaron-he-zhu/ad-creative-builder
Audit payload hash
7fbd7c37a4e0ca2bcc7d61f8613694a1

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable