skills/aeonfun/aeon/schedule-ads/Gen Agent Trust Hub

schedule-ads

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses ./secretcurl to interact with the AdManage.ai API. This is a standard practice for secure handling of API keys within this environment, as it prevents the key from appearing in the process tree or shell history. The command arguments are strictly controlled via declarative configuration files.
  • [DATA_EXPOSURE]: The skill requires ADMANAGE_API_KEY, which is handled through the environment's requires directive and secretcurl mechanism. This is the recommended secure pattern for credential management in this platform. Sensitive state is stored locally in .admanage-state/campaigns.json and .pending-admanage/, which is appropriate for its purpose.
  • [COMMAND_EXECUTION]: The skill uses python3 for logic and jq for JSON parsing. These are used for data processing (validating spend caps and computing configuration diffs) rather than dynamic code execution or arbitrary command injection.
  • [SAFE]: The skill implements a 'fail-closed' security posture for financial operations. For instance, if the daily spend cap cannot be verified due to an API error, the skill terminates rather than proceeding with potential ad launches.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 06:37 PM
Security Audit — agent-trust-hub — schedule-ads