Meta Ads Audience Analysis

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.1.0

Overview

This skill is a disclosed Meta Ads analysis helper that uses expected read-only ad account access and stores limited analysis outputs for a related recommendation workflow.

Install only if you are comfortable giving the agent read-only Meta Ads access for the intended ad account. Use the narrow ads_read scope, avoid broad or long-lived tokens when possible, and review any downstream recommendation skill before letting it act on the stored audience and budget findings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly writes audience findings and budget reallocation details into session context, which creates persistence of potentially sensitive marketing intelligence without any notice, consent, retention limit, or scoping guidance. While this is not credential exposure, campaign segmentation, overlap, and budget strategy data can be sensitive business information and may be unintentionally exposed to other skills, later steps, or users depending on how session context is shared.

VirusTotal

66/66 vendors flagged this skill as clean.