PipiAds - TikTok & Facebook Adspy Intelligence

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:50 AM UTC
• Version: 1.0.6

Overview

The skill is a clearly disclosed PipiAds MCP integration, with the main risk being normal third-party npm package and API-key exposure risk rather than hidden or malicious behavior.

Install this only if you trust the published pipiads-mcp-server npm package and are comfortable giving it access to your PipiAds API key. Use a limited, revocable API key where possible, avoid sending sensitive images or private customer data, and prefer an isolated environment if the workstation contains sensitive files or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unaudited Third-Party MCP Package Is Installed Globally and Executed with an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–20 and 48–71
Vulnerability Type: Third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata:
  openclaw:
    requires:
      env:
        - PIPIADS_API_KEY
      bins:
        - npm
    install:
      command: npm
      args:
        - install
        - -g
        - "pipiads-mcp-server@1.0.3"
    primaryEnv: PIPIADS_API_KEY
    emoji: "📊"
    homepage: https://www.pipiads.com
    mcpServers:
      pipiads:
        command: pipiads-mcp-server
        env:
          PIPIADS_API_KEY: "{{PIPIADS_API_KEY}}"

markdown

## Trust & Execution Model

This skill installs `pipiads-mcp-server@1.0.3` from the npm registry and runs it locally as an MCP server.

This means:

- npm install scripts may run during installation
- the installed package executes on the local machine
- all API access is mediated through that local MCP server

If you require stricter controls, review the npm package contents and run it in an isolated environment before using it on a primary workstation.

## Verification

This skill depends on:

- official website: `https://pipiads.com/`
- API portal: `https://www.pipispy.com/`
- npm package: `pipiads-mcp-server@1.0.3`

Review the package source, publisher, and release history if you need stronger supply-chain assurance before installation.

Technical Analysis

The Skill directs the host to retrieve pipiads-mcp-server@1.0.3 from the npm registry, install it globally, and execute its binary while providing PIPIADS_API_KEY in the process environment. The audited project contains no local copy of the server source, lockfile, expected registry integrity hash, cryptographic signature, or other mechanism that independently verifies the retrieved artifact.

Pinning the package version reduces unintended version drift, but it does not establish the integrity or trustworthiness of that release. If the package artifac ...[truncated 2752 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify the exact artifact

   • Record and enforce the expected npm integrity hash for pipiads-mcp-server@1.0.3.
   • Use a lockfile or equivalent immutable dependency manifest.
   • Confirm package provenance, publisher identity, source repository, and release history.

2. Avoid global installation

   • Install the dependency into a dedicated project directory rather than using npm install -g.
   • Invoke the project-local binary through an explicit, immutable path.
   • Prevent the package from replacing or shadowing unrelated global tools.

3. Restrict installation-time execution

   • Disable npm lifecycle scripts with --ignore-scripts where compatible.
   • If lifecycle scripts are required, inspect and allowlist them before execution.
   • Perform installation in an isolated build environment without production credentials.

4. Sandbox the MCP process

   • Run it in a container or restricted service account.
   • Deny access to unrelated home-directory files, SSH keys, credential stores, and host sockets.
   • Restrict outbound network access to verified PipiAds endpoints.
   • Use read-only filesystems and resource limits where practical.

5. Reduce credential exposure

   • Supply a narrowly scoped, revocable API token with the minimum required permissions.
   • Keep the token unavailable during package installation.
   • Rotate the token after suspected package or publisher compromise.
   • Apply spending and usage limits to reduce the consequences of unauthorized API calls.

6. Audit before deployment

   • Vendor or independently review the MCP implementation and its transitive dependencies.
   • Scan the resolved package for lifecycle scripts, dynamic code retrieval, credential access, and undeclared network destinations.
   • Revalidate the artifact before use on primary or sensitive workstations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.