ZuckerBot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This Meta ads skill is purpose-aligned but needs Review because it can affect live ad spend and uses a third-party credential intermediary without enough documented safeguards.

Review this carefully before installing. Only use it if you trust zuckerbot.ai and the MCP package, understand what Meta OAuth permissions are granted, can revoke the API key and Meta authorization, and are prepared to manually confirm every campaign launch, resume, budget change, and conversion-data upload before it happens.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: Skill.MD:10
• Finding: Unverified Third-Party MCP Dependency and Credential Intermediary## Vulnerability Details **File Location**: `Skill.MD`, lines 10-14 and 23-28 **Vulnerability Type**: Third-party supply-chain and credential-handling risk **Risk Level**: High ### Vulnerable Code Snippet ```yaml compatibility: tools: - zuckerbot MCP server (npm: zuckerbot-mcp@0.2.7) auth: - Facebook OAuth (via zuckerbot.ai developer page) - ZuckerBot API key (generated post-OAuth) ``` ```markdown Before any tool can be called, the user must: 1. Connect their Facebook account at **zuckerbot.ai** (OAuth flow) 2. Generate an API key from the developer page 3. Provide the API key — ZuckerBot stores credentials, so this is a one-time step per session If the user hasn't authenticated yet, prompt them to visit zuckerbot.ai before proceeding. ``` ### Technical Analysis The Skill delegates privileged Meta advertising operations to the external `zuckerbot.ai` service and the npm package `zuckerbot-mcp@0.2.7`. Pinning a package version reduces unexpected version drift, but the documentation does not provide a package integrity hash, verified publisher identity, official source repository, lockfile, reproducible installation procedure, or other mechanism for detecting package substitution. The external service also acts as an authentication intermediary. Users are instructed to connect their Facebook account through its OAuth flow, generate an API key, and provide that key to MCP operations. The statement that ZuckerBot stores credentials is not accompanied by information about OAuth scopes, encryption, retention, revocation, logging, or access-control boundaries. This dependency and intermediary are relevant to the declared advertising functionality, so external access is not inherently unauthorized. However, the documented controls are insufficient for a component capable of managing campaigns and spending. ### Attack Path 1. A user follows the Skill's instructions and visits `zuckerbot.ai`. 2. ...[truncated 1033 chars]
• Remediation: ## Remediation Suggestions - Identify and verify the official npm publisher, source repository, and service operator. - Provide a cryptographic integrity hash or lockfile for the MCP package and use reproducible installation procedures. - Document every requested Meta OAuth scope and justify it against the operations offered by the Skill. - Request only minimum necessary permissions and avoid account-wide or administrative access where campaign-specific access is sufficient. - Document credential encryption, storage location, retention, log-redaction, rotation, deletion, and incident-response practices. - Provide clear procedures for revoking both the ZuckerBot API key and Meta OAuth authorization. - Require TLS certificate validation for all service traffic and fail closed on authentication or integrity errors. - Subject dependency updates and backend changes to security review before deployment.

T09 · Insecure Skill Coding Practices

Error

• Location: Skill.MD:72
• Finding: Campaign Launch and Resume Operations Lack a Mandatory User Confirmation Boundary## Vulnerability Details **File Location**: `Skill.MD`, lines 72-96 and 166-180 **Vulnerability Type**: Unsafe execution of financially consequential operations **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### `zuckerbot_launch_campaign` Launch a single campaign variant on Meta (Facebook/Instagram). **When to use:** User has a campaign ready and wants to go live with one variant. **Key inputs:** - Campaign object (from `create_campaign` or user-provided) - `api_key` **Output:** Campaign ID, live status, confirmation summary. --- ### `zuckerbot_launch_all_variants` (A/B Testing) Launch multiple ad variants simultaneously for A/B testing. **When to use:** User wants to test multiple creatives, headlines, or audiences against each other. Preferred over single launch when optimisation is the goal. **Key inputs:** - Array of campaign variant objects - `api_key` **Output:** Array of campaign IDs and launch confirmations per variant. ``` ```markdown ## Recommended Workflows ### Launch a new campaign from scratch 1. `research_market` → understand audience size and benchmarks 2. `research_competitors` → analyse the landscape 3. `preview_campaign` → generate strategy from URL 4. `create_campaign` → build the campaign object 5. `generate_ad_creative` → create visuals 6. `launch_all_variants` → go live with A/B test variants 7. `get_performance` → monitor results ### Quick launch (user has clear brief) 1. `create_campaign` → build campaign 2. `launch_campaign` → go live 3. `get_performance` → check results ``` ### Technical Analysis Launching a Meta campaign or resuming a paused campaign is a consequential action that can publish content and incur financial charges. The recommended workflows move directly from campaign creation to launch without requiring a separate, immediate user confirmation. The documentation does not require the Agent to show the selected adver ...[truncated 1601 chars]
• Remediation: ## Remediation Suggestions - Require explicit user confirmation immediately before every launch, bulk launch, resume, budget increase, or schedule extension. - Present a final immutable summary containing the advertising account, campaign name, objective, audience, placements, creatives, number of variants, daily budget, total cap, start time, and end time. - Bind confirmation to a hash or unique identifier for the exact campaign configuration and invalidate it whenever that configuration changes. - Enforce server-side daily, per-campaign, and account-wide spending limits rather than relying only on Agent instructions. - Default newly created campaigns to draft or paused state. - Require stronger confirmation for bulk variant launches and display the aggregate maximum expenditure. - Validate all generated and user-provided campaign fields against strict schemas and reject unexpected values. - Record an audit trail of the approving user, approved configuration, timestamp, and resulting Meta campaign identifiers.

T09 · Insecure Skill Coding Practices

Warning

• Location: Skill.MD:145
• Finding: Sensitive Conversion Data Is Transmitted Through an External Service Without Defined Data-Minimization Controls## Vulnerability Details **File Location**: `Skill.MD`, lines 145-158 and 207-208 **Vulnerability Type**: Insufficiently constrained sensitive-data transmission **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### `zuckerbot_sync_conversion` Send conversion feedback to Meta's algorithm to improve targeting. **When to use:** User has confirmed conversions (purchases, leads, sign-ups) and wants to feed that signal back to Meta for optimisation. Use after campaigns have been running and have conversion data. **Key inputs:** - Conversion event data - `campaign_id` - `api_key` **Output:** Confirmation that the conversion signal was sent to Meta. ``` ```markdown - **Credentials:** ZuckerBot uses stored credentials — once the user authenticates, the API key handles all subsequent calls without re-auth ``` ### Technical Analysis Conversion-event data for purchases, leads, and sign-ups may contain personal identifiers, transaction details, customer activity, or commercially sensitive information. The Skill instructs the Agent to send this data through the third-party ZuckerBot service to Meta but does not define an allowed event schema or prohibit unnecessary raw personal data. No requirements are provided for local hashing, pseudonymization, consent validation, redaction, transport controls, data retention, geographic processing, or suppression of sensitive fields in logs. The persistent credential model also means the API key is repeatedly supplied to operations without documented handling protections. Sending conversion signals is relevant to campaign optimization and therefore supports the declared functionality. The security concern is that transmission is not limited to the minimum data necessary and lacks documented privacy and credential safeguards. ### Attack Path 1. A user or connected system supplies lead, purchase, or sign-up records to the Agent. 2. The Agent packages the records as un ...[truncated 831 chars]
• Remediation: ## Remediation Suggestions - Define a strict allowlist schema for conversion events and reject unknown or unnecessary fields. - Collect and transmit only data required by the Meta conversion API. - Hash or pseudonymize supported customer identifiers locally before sending them to the third-party service. - Prohibit secrets, authentication tokens, free-form notes, payment-card data, and unrelated personal information in conversion events. - Require explicit user approval before each conversion upload or clearly bounded batch. - Require an attestation that appropriate notice, consent, and lawful processing authority exist. - Document all recipients, processing purposes, retention periods, deletion procedures, and geographic processing locations. - Encrypt data in transit and at rest, redact event data and API keys from logs, and limit service access using role-based controls. - Support API-key rotation and revocation and use short-lived, narrowly scoped credentials where available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger condition is excessively broad: it activates not only for explicit requests to manage ads, but for essentially any mention of Meta, Facebook, Instagram, or advertising in related contexts. In a skill that can create, launch, pause, and optimize paid campaigns, over-invocation materially increases the chance an agent will route into spend-affecting tooling without sufficiently specific user intent or confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents launch capabilities but does not prominently warn that these actions can spend real money or change live ad delivery. In this context, missing spend/risk warnings makes accidental launches or unsafe automation more likely, especially when combined with the broad invocation guidance and workflows that proceed from creation to launch.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill encourages sending conversion event data back to Meta but does not warn that this may involve sharing personal, behavioral, or transaction-related data with a third party. In an ad-tech context, omission of a privacy and consent notice raises the risk of unauthorized data sharing, policy violations, and regulatory exposure if agents transmit conversion payloads without validating lawful basis and minimization.

Static analysis

No suspicious patterns detected.