X Ads CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for read-only X Ads reporting, but it asks the agent to install an unpinned global third-party CLI that will handle OAuth credentials and sensitive ad and billing data.

Review this before installing. Prefer a pinned, locally installed, reviewed version of `x-ads-cli`; verify the package source and integrity; use least-privileged X Ads credentials; do not print or share OAuth secrets; and run billing or funding-instrument commands only when you intend to inspect sensitive payment metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-32
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

If the CLI is not installed, install it:

```bash
npm install -g x-ads-cli

text

### Technical Analysis

The Skill directs the agent to install the latest available version of `x-ads-cli` globally from the npm registry. The command does not specify an exact reviewed version, validate package integrity, restrict lifecycle scripts, or require explicit user approval.

Because the project contains only `SKILL.md`, the CLI implementation is outside the audited artifact. Consequently, its claimed read-only behavior, network destinations, OAuth credential handling, and installation scripts cannot be verified from this project.

A global npm installation may execute package lifecycle scripts with the privileges of the user running npm. The resulting executable is also trusted with four sensitive OAuth values: API Key, API Secret, Access Token, and Access Token Secret. These may be obtained from environment variables, an explicitly supplied file, or `~/.config/x-ads-cli/credentials.json`.

The documented credential-file access is functionally necessary for authenticated X Ads API operations and does not, by itself, exceed the Skill's declared purpose. The risk arises because an unpinned and unaudited dependency is given access to those credentials and associated advertising data.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or a future release of `x-ads-cli`.
2. The agent finds that the CLI is unavailable and follows the documented `npm install -g x-ads-cli` instruction.
3. npm downloads the current package version rather than a previously reviewed, integrity-verified version.
4. Malicious package lifecycle code can execute during installation with the installing user's privileges.
5. When invoked, the compromised CLI can read the 
...[truncated 1037 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin x-ads-cli to an exact, reviewed version rather than installing the latest release implicitly.
2. Verify the package's provenance, publisher identity, repository linkage, and integrity before installation.
3. Record and validate an expected package integrity hash where the installation mechanism permits it.
4. Prefer a project-local, lockfile-controlled installation over modifying the user's global Node.js environment.
5. Disable npm lifecycle scripts during installation where compatible, or separately review every required lifecycle script.
6. Require explicit user confirmation before installing third-party software.
7. Audit or vendor the CLI implementation so its network behavior, OAuth signing, credential access, and read-only claims can be verified.
8. Use OAuth credentials with the narrowest available permissions and account access.
9. Protect the credentials file with restrictive filesystem permissions and never print credential values in command output, logs, or error messages.
10. Document the expected API hosts and consider outbound-network restrictions so the CLI cannot transmit credentials to unrelated destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

## Authentication

The CLI requires four OAuth 1.0a credentials: API Key, API Secret, Access Token, and Access Token Secret. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variables: `X_ADS_API_KEY`, `X_ADS_API_SECRET`, `X_ADS_ACCESS_TOKEN`, `X_ADS_ACCESS_TOKEN_SECRET`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

## Authentication

The CLI requires four OAuth 1.0a credentials: API Key, API Secret, Access Token, and Access Token Secret. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variables: `X_ADS_API_KEY`, `X_ADS_API_SECRET`, `X_ADS_ACCESS_TOKEN`, `X_ADS_ACCESS_TOKEN_SECRET`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md

## Authentication

The CLI requires four OAuth 1.0a credentials: API Key, API Secret, Access Token, and Access Token Secret. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variables: `X_ADS_API_KEY`, `X_ADS_API_SECRET`, `X_ADS_ACCESS_TOKEN`, `X_ADS_ACCESS_TOKEN_SECRET`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

1. `--credentials <path>` flag (per-command)
2. Environment variables: `X_ADS_API_KEY`, `X_ADS_API_SECRET`, `X_ADS_ACCESS_TOKEN`, `X_ADS_ACCESS_TOKEN_SECRET`
3. Auto-detected file: `~/.config/x-ads-cli/credentials.json`

The credentials file format:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation tells users to supply API keys and access tokens through environment variables or a local credentials file, but it does not warn that these secrets must not be exposed, echoed, or shared in outputs. Because the skill involves authentication material and API access, the markdown should explicitly caution about credential sensitivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file instructs use of the funding-instruments command to list payment methods on file, which can surface sensitive financial account metadata. The description provides no explicit warning that billing/payment data may be sensitive or should only be accessed when the user intends to review such information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.