ClawHub
Back to skill

Security audit

Meta Ads Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to manage Meta ads, but it can make spend-affecting live account changes with weak confirmation rules and risky token handling.

Install only if you are comfortable giving the agent Meta ad-account authority. Before use, require least-privilege, short-lived tokens stored in secret management; do not paste tokens into chat; avoid URL query-string token examples; and require explicit confirmation before any activation, budget change, or other spend-affecting action.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

Meta Access Token Exposure Through Command Arguments and URL Query Strings

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-20 and 109-119
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

markdown
Use exec + curl with your META_ACCESS_TOKEN. All requests go to `https://graph.facebook.com/v21.0/`.

Example structure:
```bash
curl -X POST "https://graph.facebook.com/v21.0/act_{AD_ACCOUNT_ID}/campaigns" \
  -d "access_token={META_ACCESS_TOKEN}" \
  -d "name=My Campaign" \
  -d "objective=LEADS" \
  -d "status=PAUSED"
text

```markdown
**Step 1: Get source campaign structure**

GET https://graph.facebook.com/v21.0/[CAMPAIGN_ID]?fields=id,name,status,objective,daily_budget&access_token=[TOKEN]

text

**Step 2: Get source adsets**

GET https://graph.facebook.com/v21.0/[ADSET_ID]?fields=id,name,status,optimization_goal,targeting,daily_budget,bid_amount&access_token=[TOKEN]

text

**Step 3: Get source ads**

GET https://graph.facebook.com/v21.0/[AD_ID]?fields=id,name,status,creative&access_token=[TOKEN]

text

Technical Analysis

The Skill instructs the agent to substitute a Meta bearer token directly into a curl command and into URL query strings. A token expanded into a command may be exposed through process inspection, shell tracing, command history, execution telemetry, or captured diagnostic output.

Embedding the token in a URL creates additional exposure because complete URLs are commonly recorded by shell history, HTTP clients, proxies, monitoring systems, and request or error logs. Although HTTPS protects the request in transit, it does not prevent disclosure through these endpoint and logging surfaces.

This behavior also conflicts with the Skill's own security rule stating that access tokens must never be logged or printed in plaintext.

Attack Path

  1. The agent retrieves META_ACCESS_TOKEN from configured secret storage.
  2. Following the documented examples, it substitutes the real token into a generated curl argument or URL query string.

...[truncated 1123 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove every example that places access_token in a URL query string.
  2. Retrieve the token from the platform's secret-management facility only at request time.
  3. Authenticate using Meta's supported authorization-header mechanism rather than a query parameter.
  4. Use an HTTP integration capable of injecting secret headers without placing the expanded token in generated command text. If a shell must be used, prevent tracing and avoid echoing, logging, or persisting the command.
  5. Configure automatic redaction for authorization headers, tokens, request dumps, error messages, and tool telemetry.
  6. Ensure URLs can be logged safely because they no longer contain credentials.
  7. Apply least-privilege scopes, short expiration periods, asset restrictions, and regular token rotation.
  8. Revoke and replace any real token previously used through the documented query-string pattern.
  9. Add an explicit validation rule prohibiting execution whenever a constructed command or URL contains the token value.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
| META_ACCESS_TOKEN | Meta Developer Console → Graph API Explorer → Generate Token | All Meta Marketing API calls |
| META_AD_ACCOUNT_ID | Ads Manager URL: `adsmanager.facebook.com/act_XXXXXXXXX` | All campaign operations |

> META_APP_ID and META_APP_SECRET are not needed — the access token alone is sufficient for all API operations.

## How to Call the Meta API
Use exec + curl with your META_ACCESS_TOKEN. All requests go to `https://graph.facebook.com/v21.0/`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
- META_AD_ACCOUNT_ID — format: act_XXXXXXXXX (from Ads Manager URL)

If credentials are not yet configured: Guide the user to get them:
1. Access Token: Go to developers.facebook.com/tools/explorer → select App → Generate Token → copy
2. Ad Account ID: adsmanager.facebook.com → Account Settings → find act_XXXXXXXXX

Store credentials securely. Never paste tokens into open conversation unless absolutely necessary.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
---

## Output Rules
- Always confirm what was done: "Campaign created in PAUSED status. Ready to review before I activate it."
- After any change, summarize what changed and what to expect
- If user asks for a campaign list, format as a readable table

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
---

## Security Rules
- Never log or print access tokens in plain text
- Store credentials in platform's secret management only
- Only use credentials for Meta Marketing API — never for other purposes

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

META_APP_ID and META_APP_SECRET are not needed — the access token alone is sufficient for all API operations.

How to Call the Meta API

Use exec + curl with your META_ACCESS_TOKEN. All requests go to https://graph.facebook.com/v21.0/.

Example structure:

bash

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill's invocation scope is broad enough to match many generic ad-management requests, increasing the chance the agent is selected for high-impact account changes without strong task boundaries. In a skill that can create, modify, pause, and activate paid campaigns, overbroad routing raises the risk of unintended live changes and spend-affecting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guidance allows campaign activation after review but does not consistently require an explicit, immediate user confirmation right before switching status to ACTIVE. Because this skill controls paid advertising state, a missing confirmation gate can cause unauthorized launches, budget spend, or policy exposure from a misunderstood or stale instruction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.