Versioned security assessment

Report ID: SA-635F69FB

7/13/2026, 11:48:35 AM

ad-creative-builder security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ad-creative-builder
Version
v18.0.0
Maintainer
aaron-he-zhu
Source
github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/ad/orchestrate/ad-creative-builder
Coverage
3 Files scanned · 178 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most command and traversal alerts are Markdown formatting or fixed repository links with no dynamic execution. Two external-command findings are confirmed because the workflow directs agents to an unaudited script. The user-derived save path and unrestricted destination retrieval also create high-risk path and network exposure.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 178 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 12 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 15 evidence locations

Capability review items (3)
High
SKILL.md:72
Path traversal sequence
On user confirmation, save to `memory/ad/ad-creative-builder/YYYY-MM-DD-<offer>.md` with the depende
The save target includes the user-derived <offer> value without a filename-sanitization rule. Separators or traversal content could escape the intended directory when the path is materialized.
Medium
SKILL.md:39
Ruby/shell backtick execution
- **Writes**: a user-facing creative set and, with permission, a WARM artifact; unresolved claims be
The line directs unresolved claims through registry-events.py, an executable absent from the audited package. Its behavior and state changes cannot be verified here.
Medium
SKILL.md:66
Ruby/shell backtick execution
Never invent a statistic, price, guarantee, or testimonial. When the canon and claims pointers are c
The instruction tells the agent to submit data through registry-events.py, which implies invoking an unaudited executable outside this package. No safe invocation or permission boundary is defined.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
SKILL.md:57-58
Unvalidated Retrieval of User-Supplied URLs
The workflow requires reading a destination URL supplied by the user but does not require scheme, redirect, or private-network validation. A crafted URL could target local services or sensitive internal endpoints.
The instructions explicitly accept and read a user-provided destination URL. No restriction blocks local addresses, nonstandard schemes, or redirects.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    The output filename embeds the user-provided offer value without a sanitization requirement.
    Convert the offer to a restricted filename slug, reject separators and traversal tokens, and verify the resolved path stays under the output directory.
  2. FIX-002
    High
    The workflow reads an arbitrary destination URL without network-boundary validation.
    Allow only HTTP and HTTPS, block loopback and private addresses, revalidate redirects, and require confirmation before accessing unusual hosts.
  3. FIX-003
    Medium
    The workflow directs agents to use registry-events.py, but that executable is outside the audited package.
    Include and audit the script, define a structured invocation, and require explicit confirmation before it changes shared state.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
Content hash
1b147c5d8484834d8b4c968047e1370b4ce802de841c4163cdbdca6b2e984c21
Tree hash
04c442250199e5606859cf9f3d9aedf32da845abb726d64cadecc72e18ad1702
Skill path
skills/aaron-he-zhu/ad-creative-builder
Audit payload hash
e9c36562e35da07c66e34a8acd700f2f

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable