Security audit

SnapChat Ads CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Snapchat Ads reporting, but it combines sensitive account and billing access with an unpinned global third-party CLI install that will handle the user's OAuth token.

Install only if you trust the npm package and are comfortable letting it use a Snapchat Ads OAuth token. Prefer a pinned, reviewed, local or sandboxed install; use a narrowly scoped and short-lived token; avoid exposing full billing, member, audience, or campaign records in logs or shared chats; rotate the token if package behavior is unexpected.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Global Installation of an Unaudited Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Record and verify package integrity and provenance before installation. Use a lockfile where possible, validate npm provenance signatures, and compare the package tarball against an approved cryptographic digest. 3. Include or vendor the reviewed CLI source code in the Skill package so its credential handling, API destinations, and read-only guarantees can be audited. 4. Avoid global installation. Prefer a project-local, isolated installation under a dedicated directory with minimum filesystem permissions. 5. Disable npm lifecycle scripts where compatible: ```bash npm install --ignore-scripts snapchat-ads-cli@ ``` If lifecycle scripts are required, review each script and its transitive execution chain before permitting it. 6. Run the CLI as a non-administrative user in a sandbox or container with: - Access only to the required credential. - Restricted filesystem access. - Outbound network access limited to documented Snapchat API endpoints. - No access to unrelated secrets or environment variables. 7. Document the expected Snapchat API hosts and enforce destination allowlisting so OAuth credentials cannot be sent to arbitrary endpoints. 8. Use a narrowly scoped, short-lived OAuth token and rotate it immediately if package compromise or unexpected network activity is suspected. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
## Authentication The CLI requires a Snapchat **OAuth2 access token**. Credentials are resolved in this order: 1. `--credentials <path>` flag (per-command) 2. Environment variable: `SNAPCHAT_ADS_ACCESS_TOKEN`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
## Authentication The CLI requires a Snapchat **OAuth2 access token**. Credentials are resolved in this order: 1. `--credentials <path>` flag (per-command) 2. Environment variable: `SNAPCHAT_ADS_ACCESS_TOKEN`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
1. `--credentials <path>` flag (per-command) 2. Environment variable: `SNAPCHAT_ADS_ACCESS_TOKEN` 3. Auto-detected file: `~/.config/snapchat-ads-cli/credentials.json` The credentials file format:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
1. `--credentials <path>` flag (per-command) 2. Environment variable: `SNAPCHAT_ADS_ACCESS_TOKEN` 3. Auto-detected file: `~/.config/snapchat-ads-cli/credentials.json` The credentials file format:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill repeatedly describes the CLI as 'read-only' while later documenting at least one POST-style operation (audience-insights) and multiple commands that retrieve sensitive operational and billing data. This mismatch can cause an agent or user to authorize execution under a false assumption of safety, weakening trust boundaries and enabling unintended data exposure or side-effecting API use.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Claiming the tool is read-only while also documenting a POST capability is a documentation integrity problem that can mislead downstream automation and operators into treating the skill as lower risk than it is. Even if the POST endpoint is informational, using POST breaks the stated trust model and may trigger unintended server-side actions or broader permissions than expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises access to invoices, transactions, funding sources, members, roles, audiences, and account structures without warning that outputs may contain sensitive financial, organizational, or advertising data. In an agent setting, lack of an explicit sensitivity warning increases the chance of over-broad use, accidental disclosure in logs, or exposing confidential business information to an unintended party.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.