Meta Video Ad Analyzer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it advertises: analyze user-provided ad videos or images with local media tools and Google AI services, with privacy and dependency cautions.

Install this in a dedicated virtual environment or container, pin dependency versions if you need reproducibility, and only analyze media that you are allowed to send to Google AI services. Treat extracted descriptions and OCR text as untrusted analysis output, especially when reviewing ads from unknown sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_extractor.py:294

Finding

Untrusted Media and OCR Content Can Indirectly Inject Instructions into Gemini Prompts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose says the skill performs video analysis with OCR, transcription, and Gemini Vision, but the detected behavior indicates prompt/template loading, markdown parsing, and variable substitution instead. This mismatch is dangerous because it can conceal what the skill actually does from users and reviewers, creating an opportunity for hidden prompt injection, deceptive data handling, or execution paths unrelated to the claimed video-analysis purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises capabilities that require environment access, file reads, and shell execution, but it does not declare any explicit tool scope or permissions. This weakens containment and reviewability because an agent may invoke the skill without clear visibility into the sensitive capabilities it expects, increasing the chance of unintended file access or command execution in a broader runtime context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not clearly warn that uploaded videos/images and derived audio or transcripts may be sent to external Google AI services. This creates a data-governance and privacy risk because users may provide sensitive creative assets, voice content, or embedded personal data without informed consent about third-party processing and retention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

EasyOCR is initialized with ['en'], which forces English-only text extraction. The file does not offer a language selection mechanism or explain why English-only OCR is required, so this is a locale-policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_extractor.py (reported line 121)May include surrounding context.

python

def _get_video_duration(self, video_path: str) -> float:
        """Get video duration using ffprobe."""
        try:
            result = subprocess.run(
                ["ffprobe", "-v", "error", "-show_entries", "format=duration",
                 "-of", "default=noprint_wrappers=1:nokey=1", video_path],
                stdout=subprocess.PIPE,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The extractor sends image frames and potentially whole videos to external AI services for analysis, but the code provides no consent gate, warning, or configuration boundary around that data transfer. In a media-analysis skill, this is more significant because uploaded ads may contain sensitive creative, faces, voices, or proprietary campaign content, creating privacy and data-governance exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest says the skill supports audio transcription using Google Cloud Speech, but it does not mention accessing environment-based credentials. Reading GOOGLE_APPLICATION_CREDENTIALS introduces credential-handling behavior that is not intrinsic to ad-content analysis itself and should be explicitly declared if intended.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_extractor.py (reported line 719)May include surrounding context.

python

audio_path = temp_f.name

            try:
                subprocess.run([
                    'ffmpeg', '-i', video_path, '-vn', '-f', 'wav',
                    '-acodec', 'pcm_s16le', '-ar', '16000', '-ac', '1',
                    '-y', audio_path

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The transcription configuration forces language_code="en-US", which imposes a specific locale regardless of user preference or input media language. This matches the policy category for language or locale constraints that are not optional or explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is scoped to video-ad analysis, frame extraction, OCR, audio transcription, and scene analysis for videos. However, extract_content explicitly routes image files into a separate image-analysis path, and the module includes dedicated image OCR and thumbnail generation logic.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest presents the skill as an analyzer for ad content, which suggests read/compute behavior over supplied media. This implementation persists derived thumbnails under a static/thumbnails directory, adding a file-writing side effect not described in the manifest text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code creates a static/thumbnails directory and writes JPEG thumbnail files derived from user media. Although the helper method name implies saving, there is no explicit user-facing disclosure in logs, prompts, or surrounding documentation that processing will create persistent local files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

For static images, the code creates and saves JPEG thumbnails in a local directory. This is a persistent output behavior beyond the manifest's stated extraction and analysis scope, and it is also part of the broader undocumented image-processing capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.