T09 · Insecure Skill Coding Practices
Error
- Location
scripts/meta_ad_creatives.py:76- Finding
Meta Access Token Exposure Through Query Strings and Exception Logging
- Content
View full analysis
- Remediation
View remediation
Security audit
Meta Ad Creatives
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it handles Meta access tokens and stored ad data in ways users should review before installing.
Install only if you are comfortable giving the skill a Meta Ads access token and having ad performance data cached locally. Use a least-privilege, revocable Meta token, restrict log access, and consider modifying the script to use Authorization headers, redact errors, validate pagination hosts, and define cleanup or storage protections for the SQLite data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tainted flow: 'params' from os.getenv (line 147, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python all_ads = [] try: while url: response = requests.get(url, params=params, timeout=60) response.raise_for_status() data = response.json() all_ads.extend(data.get('data', []))
Tainted flow: 'params' from os.getenv (line 147, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python all_ads = [] try: while url: response = requests.get(url, params=params, timeout=60) response.raise_for_status() data = response.json() all_ads.extend(data.get('data', []))
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documentation shows it relies on environment secrets and external Meta network access, but the manifest declares no explicit tool scope or permissions boundary. That mismatch can cause the agent platform or reviewer to underestimate the skill's access needs, leading to overbroad implicit permissions, unsafe execution, or accidental secret exposure when the skill is invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The requests to the Meta Graph API send ad account identifiers, access tokens, filtering parameters, and query details over the network. Although network access is central to the script's purpose, the file lacks a visible user disclosure in the CLI/help text or module documentation that running it will contact Meta's external service and process account data remotely.
- Content
Tainted flow: 'url' from requests.get (line 103, network input) → requests.get (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python all_ads = [] try: while url: response = requests.get(url, params=params, timeout=60) response.raise_for_status() data = response.json() all_ads.extend(data.get('data', []))
Tainted flow: 'url' from requests.get (line 103, network input) → requests.get (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python all_ads = [] try: while url: response = requests.get(url, params=params, timeout=60) response.raise_for_status() data = response.json() all_ads.extend(data.get('data', []))
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script persists detailed ad-performance data locally in SQLite, including account names, campaign names, ad names, spend, impressions, clicks, and performance outcomes, without any access controls, encryption, retention policy, or user disclosure. In an agent/skill environment, this can expose sensitive client marketing data to other local users, processes, backups, or later tasks that read the same workspace.
- Content
Static analysis
No suspicious patterns detected.