paid-ads

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill correctly instructs the agent to use the ZERNIO_API_KEY from an environment variable and explicitly forbids recording the raw key value in files or chat logs.
  • [COMMAND_EXECUTION]: The skill mandates a 'Money Gate' (돈 게이트) protocol, requiring explicit user confirmation for any campaign creation or budget modification before executing API calls.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (CRM lead lists) for audience creation.
  • Ingestion points: Section C (SKILL.md) describes uploading customer lists from a CRM via crm-connect.
  • Boundary markers: Not explicitly defined in the prompt instructions.
  • Capability inventory: Uses Python urllib to perform network requests to zernio.com for campaign management, audience updates, and data retrieval.
  • Sanitization: The skill documentation notes that SHA-256 hashing is performed on customer list data before transmission.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 06:46 AM
Security Audit — agent-trust-hub — paid-ads