Adspy & Ad Library: TikTok & Facebook

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed PipiAds research integration, but it relies on a globally installed third-party npm MCP server that receives the user's API key.

Install only if you trust the pipiads-mcp-server npm package and are comfortable giving it your PipiAds API key. Prefer a limited API key, monitor credit usage, and consider isolating the global npm install if you use this in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unaudited Third-Party npm Package Is Installed Globally and Executed with an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–15 and 20–23
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  command: npm
  args:
    - install
    - -g
    - "pipiads-mcp-server@1.0.3"

yaml

mcpServers:
  pipiads:
    command: pipiads-mcp-server
    env:
      PIPIADS_API_KEY: "{{PIPIADS_API_KEY}}"

Technical Analysis

The skill instructs npm to retrieve pipiads-mcp-server@1.0.3 from an external package registry and install it globally. It then executes the package's binary while exposing PIPIADS_API_KEY to that process.

Pinning the package version improves reproducibility but does not verify the artifact's integrity or make its implementation auditable from this project. The project contains no lockfile, cryptographic integrity hash, vendored source, or sandbox policy. Consequently, npm lifecycle scripts and the installed server execute outside the reviewed project content. A compromised package release, registry account, transitive dependency, or package-distribution channel could introduce arbitrary code.

The global -g installation increases the scope of possible changes compared with a project-local, isolated installation. The executed package also legitimately receives the API credential, meaning malicious code inside that dependency would not need to bypass an access-control boundary to read it.

Attack Path

1. An attacker compromises the published pipiads-mcp-server@1.0.3 artifact, one of its transitive dependencies, its publisher account, or the package-distribution channel.
2. A user installs the skill, causing npm to download the external package and run any permitted package lifecycle scripts with the installing user's privileges.
3. The package is installed globally, allowing malicious installation behavior to affect globally managed tooling or other locations writable by that user.
4. The skill launches the installed `pipiads-mcp-ser ...[truncated 1285 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid global installation. Install the dependency in a dedicated project directory, container, or other isolated runtime under a non-privileged account.
2. Vendor and review the MCP server source and all transitive dependencies before deployment.
3. Use a lockfile and verify registry-provided integrity hashes or signed release artifacts. Pin the full dependency graph rather than only the top-level package version.
4. Disable npm lifecycle scripts during installation where compatible, such as by using --ignore-scripts, and explicitly run only reviewed setup steps.
5. Restrict the MCP server's filesystem and network access through sandboxing, container controls, or operating-system policy.
6. Supply a narrowly scoped API key with account-side spending limits where supported. Rotate the key after suspected exposure.
7. Ensure secrets are passed only to the process that requires them and are excluded from logs, diagnostic output, and child processes.
8. Monitor package provenance and future releases, and require a fresh security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.