snapchat

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:22 PM UTC
• Version: 1.2.1

Overview

This skill is a disclosed Snapchat advertising API integration, but users should be careful with broad API access, write actions, and credentials.

Install only if you trust Maton and need Snapchat ad-management automation. Prefer OAuth, grant the narrowest Snapchat scopes available, confirm every write or connection change, pin or isolate CLI/SDK installs when possible, and avoid dumping full API responses into logs or shared terminals.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37
• Finding: Unpinned Third-Party CLI and SDK Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-45` and `SKILL.md:776-800` **Vulnerability Type**: Unpinned third-party dependencies and global package installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### NPM ```bash npm install -g @maton/cli ``` ### Homebrew ```bash brew install maton-ai/cli/maton ``` ``` Additional unpinned SDK installation instructions appear later: ```markdown **Python** ```bash pip install maton-ai ``` ```python from maton_ai import Maton, login # login() maton = Maton() # maton = Maton(api_key="...") result = maton.api.get("snapchat", "/v1/me/organizations") ``` **JavaScript** ```bash npm install @maton/sdk ``` ```javascript import { Maton, login } from "@maton/sdk"; // await login() const maton = new Maton(); // const maton = new Maton({ apiKey: "..." }); const result = await maton.api.get("snapchat", "/v1/me/organizations"); ``` ``` ### Technical Analysis The installation commands do not pin package versions, verify package integrity, or otherwise constrain the installed artifact to a reviewed release. The NPM CLI is also installed globally, increasing its reach within the user's environment. Because these packages implement authentication and API communication, a compromised package registry account, Homebrew tap, dependency, or future release could introduce code that executes during installation or subsequent use. Such code would run with the privileges of the user invoking the package manager. This is a supply-chain exposure rather than evidence that the named packages are currently malicious. The risk arises because the effective executable content can change after the Skill has been reviewed. ### Attack Path 1. An attacker compromises a package publisher, package registry account, Homebrew tap, or transitive dependency. 2. The attacker publishes a malicious release under one of the unpinned package names. 3. A user follows the Skill instructions and installs the latest a ...[truncated 1324 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI and SDK packages to specific reviewed versions instead of installing the latest release implicitly. 2. For NPM, use exact versions and verify package integrity through a lockfile or expected integrity digest. 3. For Python, use an exact version with hash verification, such as a requirements file consumed with `pip install --require-hashes`. 4. Pin the Homebrew formula or documented release and verify its checksum or signature where supported. 5. Avoid global NPM installation where possible; use a project-local or isolated installation. 6. Run package installation without administrative privileges and in an isolated environment. 7. Document the expected package publishers and official package registry URLs to reduce typosquatting and dependency-confusion risks. 8. Establish a dependency update process that reviews release provenance and changes before advancing the pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:887
• Finding: Raw HTTP Example Prints Potentially Sensitive API Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:887-906` **Vulnerability Type**: Sensitive information exposure through terminal, CI, or agent logs **Risk Level**: Low ### Vulnerable Code ```bash python3 - <<'PY' import json, os, urllib.request GATEWAY = "https://api.maton.ai" req = urllib.request.Request(GATEWAY + "/snapchat/v1/me/organizations") req.add_header("Authorization", "Bearer " + os.environ["MATON_API_KEY"]) req.add_header("User-Agent", "maton-snapchat-skill/1.2") # req.add_header("Maton-Connection", "{connection_id}") with urllib.request.urlopen(req) as resp: print(json.dumps(json.load(resp), indent=2)) PY ``` ### Technical Analysis The example serializes and prints the complete API response without field selection or redaction. Snapchat and Maton responses may contain personal or commercially sensitive information, including names, email addresses, phone numbers, organization details, account identifiers, and advertising data. Although the Skill subsequently warns users not to dump complete responses, the executable example itself defaults to doing so. Output may be retained in shell scrollback, CI logs, agent transcripts, session recordings, or centralized logging systems. The bearer credential is read from the environment and is sent only to the declared HTTPS gateway in this example. The identified issue is not the intended credential transmission; it is the unrestricted display of the returned data. ### Attack Path 1. A user executes the documented raw HTTP example in a terminal, CI job, or agent-controlled environment. 2. The gateway returns organization or account data associated with the authenticated connection. 3. The example prints the complete response body. 4. The execution environment captures standard output in logs, transcripts, terminal history, or monitoring systems. 5. A person or service with access to those retained outputs obtains information beyond what was necessary for the task. This path does ...[truncated 636 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace full-response printing with explicit extraction of the minimum fields needed to verify connectivity. 2. Redact email addresses, phone numbers, account identifiers, connection URLs, tokens, and other sensitive fields before display. 3. Avoid printing response bodies by default in CI, automated agents, or shared terminals. 4. Provide a safe verification example that displays only request status and a count of returned records. 5. Require explicit user approval before displaying personal or commercially sensitive response fields. 6. Keep raw responses in memory only and do not persist them unless the user specifically requests storage in an approved location. 7. Add a reusable redaction function if troubleshooting requires structured output. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that the documented endpoints are not a technical limit and that `maton api` can reach any Snapchat endpoint permitted by the connection. That creates an overbroad capability surface relative to the advertised marketing-management purpose, increasing the chance an agent can be steered into sensitive or unintended API actions outside the reviewed scope.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The file says `maton api` paths must start with `/snapchat/`, but much of the API reference uses bare `/v1/...` examples instead. This inconsistency can cause failed requests, troubleshooting confusion, or unsafe operator workarounds, especially in a skill that already exposes a broad passthrough surface where precise path handling matters.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The skill description focuses on managing Snapchat advertising entities and viewing stats, but the file also instructs the agent to create and delete Maton connections. While related operationally, authorization lifecycle management is a separate account-access capability that is not clearly disclosed in the core purpose statement and can revoke or establish access independent of ad management tasks.

Static analysis

No suspicious patterns detected.