spy-competitor-ads
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Bash commands to move downloaded media files from the default
~/Downloadsdirectory to/tmp/for organized delivery to the user. Evidence:cd ~/Downloads && mv -f spy-ad-*.mp4 /tmp/ && ls -la /tmp/spy-ad-*.mp4(and similar variants for other modes). - [DYNAMIC_EXECUTION]: Custom JavaScript is executed within a browser environment to handle complex page interactions such as lazy-loading content, extracting media blobs, and triggering file saves via temporary download links. Evidence: Multiple
(async () => { ... })()scripts in Step 3 for scraping and downloading media. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content (ad copy and advertiser metadata) from the Meta Ad Library, which presents a surface for indirect prompt injection.
- Ingestion points: Ad cards and metadata extracted from the Meta Ad Library DOM via
document.querySelectorAllin Step 3. - Boundary markers: Absent; the scraped text is used directly for filtering results and generating labels for user selection.
- Capability inventory: File system access (Bash
mv), browser script execution (JavaScript), and execution of downstream skills (arcads:clone-hook,arcads:clone-static-ad). - Sanitization: The skill uses a regular expression (
BRAND = /.../i) to filter results by brand name but does not explicitly sanitize the ad copy text used in user-facing labels.
Audit Metadata