T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
Meta Access Token Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Meta Ads Publisher
Security checks for vulnerabilities and agentic risk
Overview
This skill is for legitimate Meta Ads management, but it asks for write-capable ad credentials and uses risky curl/token handling for budget-impacting account changes.
Install only if you intend an agent to manage a real Meta Ads account. Use a limited, preferably short-lived token stored in secret management, avoid pasting tokens into chat, review every campaign or budget change before execution, and rotate the token if it may have appeared in command logs or URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:132- Finding
Potential Shell Command Injection Through Unvalidated API Parameter Interpolation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | META_ACCESS_TOKEN | Meta Developer Console → Graph API Explorer → Generate Token | All Meta Marketing API calls | `ads_management` (read+write) | | META_AD_ACCOUNT_ID | Ads Manager URL: `adsmanager.facebook.com/act_XXXXXXXXX` | All campaign operations | — | > META_APP_ID and META_APP_SECRET are not needed — the access token alone is sufficient for all API operations. ## How to Call the Meta API Use exec + curl with your META_ACCESS_TOKEN. All requests go to `https://graph.facebook.com/v21.0/`.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 81% confidence
- Finding
The skill instructs the user to generate and copy an access token manually, which increases the risk that the token will be pasted into chat, mishandled, stored insecurely, or exposed in logs. In this context the token has read/write ads_management privileges, so accidental leakage could enable unauthorized campaign changes and financial impact.
- Content
md - META_AD_ACCOUNT_ID — format: act_XXXXXXXXX (from Ads Manager URL) If credentials are not yet configured: Guide the user to get them: 1. Access Token: Go to developers.facebook.com/tools/explorer → select App → Generate Token → copy 2. Ad Account ID: adsmanager.facebook.com → Account Settings → find act_XXXXXXXXX Store credentials securely. Never paste tokens into open conversation unless absolutely necessary.
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md --- ## Output Rules - Always confirm what was done: "Campaign created in PAUSED status. Ready to review before I activate it." - After any change, summarize what changed and what to expect - If user asks for a campaign list, format as a readable table
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- ## Security Rules - Never log or print access tokens in plain text - Store credentials in platform's secret management only - Only use credentials for Meta Marketing API — never for other purposes
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description is broad enough to match generic campaign-management requests and can cause the agent to invoke a high-privilege write-capable skill too readily. Because this skill can create, modify, pause, activate, and duplicate ads using an ads_management token, over-broad routing increases the chance of unintended ad operations and budget-impacting actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
META_APP_ID and META_APP_SECRET are not needed — the access token alone is sufficient for all API operations.
How to Call the Meta API
Use exec + curl with your META_ACCESS_TOKEN. All requests go to
https://graph.facebook.com/v21.0/.Example structure:
bash
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The "When to Use" guidance lacks scope boundaries and negative examples, so an orchestrator may invoke this skill for loosely related campaign questions rather than only for explicit account changes. In this context, mistaken invocation is more dangerous than usual because the skill has direct write access to live ad infrastructure and can spend money or alter campaign state.
- Content
Static analysis
No suspicious patterns detected.