campaign-ide-handoff
Open or import campaigns into Synter Campaign IDE, draft plans on the canvas, and hand off for human approve ≠ activate. Use when planning in Campaign IDE, importing live campaigns into Synter UI, or moving from agent draft to human approval.
82%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Medium
Suggest reviewing before use
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
Direct operation, not indirect. `execute_campaign_plan` and "enable via gated tools" (lines 22, 30) commit real ad budgets on the user's live OAuth'd accounts, which is a delegated purchase/charge rather than a bill or draft. Ad-spend exclusions cover the agent's own service costs, not spend executed for a client's campaign. Campaign import and planning alone are not operations. Control gap: the only controls documented are an instruction to "never auto-spend" and a human approval card (lines 29-30), which the agent follows rather than the service enforcing. The OAuth prerequisite (line 12) connects accounts but is not described as authorizing `execute_campaign_plan` or enable actions. Because the skill does not document a service-enforced authorization check for the execute route, the direct operation lacks established qualifying control, so severity is high.
- Repository
Synter-Media-AI/free-skills
- Revision
3df48f1
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.