Meta Ads MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.1.0

Overview

This is a transparent Meta ads operations guide with expected ad-account and tracking workflows, plus useful safety and privacy guardrails.

Install only if you intend to let an agent assist with real Meta ad operations. Confirm the correct ad account, spending limits, Drive folder permissions, customer-data consent, and final approval before any campaign is created or activated.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tracking-and-retargeting.md (reported line 7)May include surrounding context.

The Recommended Setup: Pixel + CAPI Together

Meta Pixel (browser-side) and Conversions API / CAPI (server-side) must both be running. Never rely on Pixel alone — Safari/Firefox block third-party cookies by default, and iOS privacy changes cause 40–60% data loss in Pixel-only setups.

text

Browser Side:  User action → JavaScript Pixel fires → Meta receives event

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill's invocation criteria are very broad and can cause it to activate for general discussion of Facebook/Instagram ads, budgets, audiences, or tracking even when the user did not request campaign operations. In an agentic environment, over-broad routing increases the chance of unnecessary exposure to ad account tooling, unintended operational suggestions, or accidental execution of sensitive MCP workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The intake prompts solicit tracking configuration details and the existence of customer lists for audience uploads/exclusions without any accompanying privacy, consent, retention, or secure-handling guidance. In an operational ad-tech skill, this can normalize collecting or uploading personal data into advertising systems without verifying lawful basis, user consent, or internal approval, increasing the risk of privacy violations and mishandling of sensitive marketing data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill repeatedly states that deletes must never be used and that entities should only be paused, presenting this as a non-negotiable safety rule. However, this file is purely instructional and does not implement or enforce any technical restriction beyond mentioning ads_activate_entity; the operational guidance therefore overstates what the skill actually guarantees.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes operational guidance to store assets in a shared Google Drive folder, which could affect user or client data handling. Under the markdown-specific warning criteria, there is no accompanying caution about access controls, sensitive content, or verifying the correct destination before uploading.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.