Meta Ads CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

Review before installing: the skill is for Meta Ads reporting, but it can access sensitive ad and lead data and suggests a global unpinned CLI install.

Install only if you trust the CLI package and need Meta Ads access. Prefer a pinned or locally isolated install, use a dedicated Meta token with the minimum permissions, never paste or print token values in chat, and treat lead submissions as sensitive personal data that should be retrieved only when necessary and redacted by default.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-28
Vulnerability Type: Unsafe and unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

# Check if the CLI is available
meta-ads-open-cli --help

# Get authenticated user info
meta-ads-open-cli me

# List accessible ad accounts
meta-ads-open-cli ad-accounts

If the CLI is not installed, install it:

bash

npm install -g meta-ads-open-cli

Technical Analysis

The Skill instructs the agent to globally install the latest registry version of meta-ads-open-cli without pinning an audited version or verifying package integrity. An unversioned npm installation resolves dynamically, meaning the installed package and its transitive dependencies can change after the Skill has been reviewed.

npm packages may execute lifecycle scripts during installation. If the package, one of its dependencies, its maintainer account, or the package registry distribution channel is compromised, attacker-controlled code could execute with the privileges of the user running the installation. The global -g installation also modifies an environment outside the project directory and may expose the installed executable to unrelated sessions.

The credential auto-discovery documented at SKILL.md:31-42 is functionally relevant to authenticated Meta API access and does not itself demonstrate credential exfiltration. However, a compromised CLI installed through this dependency path could attempt to access META_ADS_ACCESS_TOKEN or ~/.config/meta-ads-open-cli/credentials.json.

Attack Path

1. An attacker compromises the npm package maintainer, published package, transitive dependency, or registry distribution path.
2. The attacker publishes a malicious release that becomes the version selected by the unpinned installation command.
3. The agent finds that the CLI is unavailable and follows the Skill instructi ...[truncated 1126 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin meta-ads-open-cli to an exact version that has been reviewed, rather than resolving the latest release:

   bash

   npm install --global --ignore-scripts meta-ads-open-cli@<reviewed-exact-version>
   

2. Verify the package source, publisher, provenance, and integrity before installation. Record an expected integrity hash where the installation mechanism permits it.
3. Avoid global installation. Prefer a project-local, isolated environment or an approved preinstalled binary so the package cannot modify shared user tooling.
4. Disable npm lifecycle scripts with --ignore-scripts unless the reviewed package demonstrably requires them. If scripts are required, audit those scripts and all transitive dependencies first.
5. Use a lockfile and automated dependency scanning for a locally managed installation.
6. Run the CLI as a non-privileged user and never invoke the npm installation with sudo or administrator rights.
7. Grant the Meta token only the API permissions required for the requested operation. Use a dedicated token and credential file with restrictive filesystem permissions.
8. Do not expose token values in command output or logs, and rotate the token if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill centers operation on a Meta OAuth access token without guardrails about secret handling. That makes credential misuse more likely, including asking users to reveal tokens, logging them in commands, or exposing them in output, which could enable unauthorized access to ad accounts and related data.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

## Authentication

The CLI requires a Meta **OAuth access token**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variable: `META_ADS_ACCESS_TOKEN`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Referencing an auto-detected credentials file gives the agent a concrete path to sensitive material and may encourage file access to obtain or validate secrets. In an LLM-agent environment, that can become a credential exposure pathway if the agent reads or surfaces the file contents during execution or debugging.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

1. `--credentials <path>` flag (per-command)
2. Environment variable: `META_ADS_ACCESS_TOKEN`
3. Auto-detected file: `~/.config/meta-ads-open-cli/credentials.json`

Required permissions depend on the commands used:
- `ads_read` -- read ad accounts and campaigns

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.

md

### Error handling

- **Authentication errors** -- ask the user to verify their access token and permissions
- **"param business is required"** -- the `account-users` command requires `--business <id>`
- **Empty insights** -- check date range, entity status, and whether the account had active ads in the period
- **Missing lead fields** -- `ad_id`/`campaign_id` require `ads_management` permission and only appear on real (non-test) leads

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly supports retrieving lead form submissions, which commonly contain personal data such as names, emails, phone numbers, and free-form responses, but it provides no warning about sensitive-data handling, minimization, or redaction. In an agent setting, this omission increases the chance that the model will fetch, display, or further process PII unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The authentication section tells the agent where credentials may be supplied or stored, including an environment variable and a local credentials file, but lacks any warning not to print, expose, or request secret values unnecessarily. In practice, this can lead an agent to over-handle credentials or reveal secret locations and values during troubleshooting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.