Security audit

Meta Ads Drop Diagnosis

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is coherent for read-only Meta Ads drop diagnosis, with a disclosed but slightly confusing recovery-plan handoff that users should review.

Install only if you are comfortable giving the agent read-only access to the specified Meta ad account. Use the narrow ads_read scope, avoid broader Meta permissions, and treat any pause, scale-down, refresh, or budget-shift output as a recommendation that should be reviewed before making changes in Ads Manager.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill's instructions conflict: it claims to be diagnosis-only, yet it directs the agent to generate specific operational actions such as pausing, scaling, refreshing, and shifting budget. That contradiction can cause the agent to exceed its intended scope and perform or recommend account-changing decisions without the safeguards or handoff expected from the separate recommendation skill.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill writes a recovery_plan into session context even though its own rules say action recommendations belong to another skill. This creates a cross-skill policy bypass where downstream components can consume prescriptive actions originating from a supposedly diagnostic tool, undermining separation of responsibilities and increasing the chance of unreviewed budget or campaign changes.

Static analysis

No suspicious patterns detected.