TikTok Ad Tracker & Monitor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:43 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed PipiAds integration for TikTok ad research and monitoring, with ordinary but real API-key and npm package risks.

Install only if you are comfortable running the PipiAds MCP package locally and sharing a revocable PipiAds API key with it. Use a narrowly scoped key if available, monitor credit usage and monitor-task changes, and remove the global npm package if you stop using the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Globally Installed Third-Party MCP Server Executes with an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-25
Vulnerability Type: Third-party dependency and supply-chain risk
Risk Level: Medium

yaml

install:
  command: npm
  args:
    - install
    - -g
    - "pipiads-mcp-server@1.0.3"
primaryEnv: PIPIADS_API_KEY
emoji: "📊"
homepage: https://www.pipiads.com
mcpServers:
  pipiads:
    command: pipiads-mcp-server
    env:
      PIPIADS_API_KEY: "{{PIPIADS_API_KEY}}"

Technical Analysis

The skill installs pipiads-mcp-server@1.0.3 globally from the npm registry and subsequently executes its binary with PIPIADS_API_KEY in its environment. Pinning the version reduces uncontrolled version drift, but the project does not provide an integrity hash, lockfile, reviewed source, or other mechanism for independently verifying the installed artifact.

npm installation can execute package lifecycle scripts. After installation, the MCP server itself runs as local code under the invoking user's privileges and receives the configured API credential. Consequently, a malicious, compromised, incorrectly sourced, or otherwise unsafe package artifact could execute arbitrary code and access the PipiAds credential.

Global installation also increases scope compared with a project-local, isolated dependency because it places the executable in a shared environment and may affect other sessions or applications using the same command name.

Attack Path

1. An attacker compromises the upstream package, its publishing process, a registry delivery path, or otherwise causes an unsafe artifact to be resolved for pipiads-mcp-server@1.0.3.
2. The skill runs npm install -g pipiads-mcp-server@1.0.3.
3. Malicious package lifecycle code may execute during installation with the privileges of the user performing the installation.
4. The installed pipiads-mcp-server executable is launched as an MCP server.
5. The process receives PIPIADS_API_KEY throug ...[truncated 1149 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer bundling and reviewing the MCP server source as part of the audited distribution rather than downloading executable code during installation.
2. Verify npm package provenance and record the expected artifact integrity hash. Use a lockfile or equivalent immutable dependency manifest where supported.
3. Install the package into a project-local, isolated environment instead of using npm install -g.
4. Disable npm lifecycle scripts with --ignore-scripts when the package does not require them. If scripts are required, audit each script and its transitive dependencies before installation.
5. Execute the MCP server in a sandbox or container with restricted filesystem, network, process, and environment access.
6. Supply a narrowly scoped, revocable API key with billing and rate limits. Do not reuse a credential that grants unrelated account permissions.
7. Restrict outbound network access to documented PipiAds endpoints so the server cannot send credentials to arbitrary hosts.
8. Monitor API usage for unexpected credit consumption or task changes, rotate the key periodically, and revoke it immediately if compromise is suspected.
9. Validate the installed executable's path and integrity before launch to reduce the possibility of command-name collision or replacement by another global package.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.