Security audit

Meta Ads Strategy: Facebook & Instagram Ads, Creative, Copy, Targeting, ROAS, Pixel, Ads Manager

Security checks for vulnerabilities and agentic risk

Overview

This Meta ads skill is mostly coherent, but it needs review because it can push live ad-account actions and includes under-scoped guidance around account restrictions, tracking, and privacy-sensitive advertising data.

Review this skill before installing. Use it for planning only unless you are prepared to approve each AdKit command and every campaign, budget, and publishing action yourself. Ignore or revise the spare ad-account and VPN advice, and add privacy/compliance checks before using pixels, email lists, retargeting, or session-recording tools.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (31)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/ad-brief.md (reported line 59)May include surrounding context.
md
## The KPIs  - AOV / LTV: - Maximum acquisition cost: _(LTV minus operational cost per user. This is the break-even point — spending more loses money.)_

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 1-fundamentals.md (reported line 111)May include surrounding context.
md
Different audiences need different messaging. Map your creative and copy to where the audience sits: | Level | Who they are | What works | Example | | ------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | **Cold** | Never heard of your brand | Show why they should care. Lead with the problem or a surprising fact. Social proof stories. | "37,000 devs laid off in 2024. Here's how to future-proof your career." | | **Warm** | Engaged with your content but haven't visited your site | Build relationship. Tutorials, differentiation, deeper value. | Educational content, comparison ads |

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Advising users to create the maximum number of spare ad accounts 'as insurance' against future restrictions normalizes planning around enforcement evasion rather than policy compliance. In this skill's context, that increases the likelihood of users bypassing restrictions and continuing ad activity after an account is disabled.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guidance explicitly suggests using a VPN set to the user's home country while traveling to avoid Meta fraud detection. In the context of an ads setup skill, this crosses from legitimate operational advice into evasion of platform trust and enforcement controls, which can facilitate account misuse and policy circumvention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file gives detailed tracking setup instructions, including pixel deployment on every page and transmission of conversion parameters, without warning about consent, privacy notices, jurisdictional requirements, or limiting collection to authorized purposes. That omission can lead users to implement tracking in ways that violate privacy law, platform rules, or their own disclosed data practices.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · 3-account-setup.md (reported line 92)May include surrounding context.
md
If no, walk them through it: 1. Install the base pixel code on every page (found in Events Manager → Data Sources → Pixel → Settings) 2. Set up standard events for key actions: always prefer standard events over custom ones (Meta has historical data to optimize standard events) | Event | When to fire | | ------------------------ | ---------------------------------------- |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The custom audience section encourages use of email lists and pixel-derived audiences but omits any warning that uploaded customer data and behavioral audiences require lawful basis, proper notice, and often consent. In an ad-tech context, this omission is significant because customer matching and retargeting are regulated and can expose users to privacy complaints or enforcement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guidance to make ads 'indistinguishable from native content' encourages blending paid promotions into organic-looking content without any balancing warning about ad transparency, disclosure, or platform advertising rules. In an ad-creation skill, this raises the risk of deceptive advertising practices, misleading users into producing creatives that obscure their promotional nature or imitate user-generated/social content in non-compliant ways.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Recommending a tool that can 'clone winning ads' normalizes copying third-party creatives without caution about copyright, trademark, right-of-publicity, or platform policy issues. In this context, users may infer they can replicate competitors' protected designs, branding, likenesses, or ad structures directly, creating legal and compliance exposure.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 6-campaign-structure.md (reported line 26)May include surrounding context.
md
Use the answers to route through this guide: | Situation | Recommended path | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | | No pixel data, no ad history | Leads objective, single ad set, low budget ($2-5/day). Jump to **Low budget setup**. | | Has pixel data, budget under $10/day | Sales objective, single ad set with Flexible Creatives. Optimize for the event with the most data. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 6-campaign-structure.md (reported line 62)May include surrounding context.
md
## Campaign Objectives | Objective | When to use | When to skip | | ------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------ | | **Sales** | You sell a product/subscription and want direct conversions. Default for most advertisers. | You have no pixel events firing yet. | | **Leads** | You collect emails, signups, or contact info. Great for pre-launch, lead-magnets, or high-touch sales. | You can already sell directly from a landing page. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 6-campaign-structure.md (reported line 68)May include surrounding context.
md
| **Leads** | You collect emails, signups, or contact info. Great for pre-launch, lead-magnets, or high-touch sales. | You can already sell directly from a landing page. | | **App Promotion** | Same as sales but when advertising a mobile apps. Requires separate tracking setup. | You don't have a mobile app. | | **Engagement/Video View** | When making retargeting audiences + cheap Social Proof. | You care about revenue, not vanity metrics. | | **Traffic** | Never, garbage traffic. | Always skip. | | **Awareness** | Massive brand-building budgets (think Coca-Cola). Don't use | You need measurable ROI. 99% of advertisers skip this. | **Most common choice:** Sales. If budget is tight or you lack pixel data, start with Leads.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 6-campaign-structure.md (reported line 85)May include surrounding context.
md
**Start broad.** Meta finds buyers without interest targeting. Over-targeting from day one limits the algorithm. | Type | Setup | Best for | | ------------------ | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | | **Interest-based** | Add relevant interests. Use Meta's "Suggestions" button to expand. Aim for 50M+ audience size. | First ad sets when you have no pixel data. | | **Broad** | No interests, no custom audiences. Just location + age. Let Meta figure it out. | Accounts with existing pixel data. Often outperforms interests. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 7-launch.md (reported line 19)May include surrounding context.
md
**How Meta's optimization loop works:** Your pixel sends conversion data to Meta. The algorithm finds similar people and shows them your ad. Some convert, feeding more data back. More data = better targeting = lower costs. This is why coupling Meta with other traffic channels accelerates learning: the pixel picks up conversions from all sources. | Goal | Use when | Typical daily budget needed | | ----------------------------------- | --------------------------------------------------------------------------------------------------------------- | --------------------------- | | **Purchase / Subscribe / Checkout** | Strong landing page, product with proven demand, enough budget for Meta to learn | (Acquisition Cost x2)/day | | **Signup / Free Trial** | Product where users convert better after trying it. Test against direct purchase: free trials don't always win. | $25+/day |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · 7-launch.md (reported line 30)May include surrounding context.
md
Collect leads and nurture with email automation instead. **Lead magnets work:** A free PDF, industry report, or tool that collects emails, followed by an automated email sequence, is one of the most cost-effective funnels for Meta ads. [Good resource for lead magnets](https://github.com/coreyhaines31/marketingskills/blob/main/skills/lead-magnets/SKILL.md). **If the chosen event has no data:** Meta is guessing, and results will be poor. Either optimize for a lower-funnel event where you have data (e.g., signup instead of purchase), drive organic conversions first, or use leads as a stepping stone.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 7-launch.md (reported line 88)May include surrounding context.
md
### Scaling Rules | Action | Rule | Why | | ------------------- | ------------------------- | ------------------------------------------------------------------------------------------- | | **Increase budget** | Max 10-15% every 48 hours | Larger jumps disrupt optimization. The algorithm needs time to recalibrate. | | **Decrease budget** | Can drop 50%+ immediately | Signals to Meta that current results are poor. Often resets optimization in a positive way. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 8-results.md (reported line 28)May include surrounding context.
md
## Key Metrics (KPIs) | Metric | What It Measures | Why It Matters | | ------------------------- | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **CPM** | Cost per 1,000 impressions | Baseline ad cost. Higher = more competitive/expensive audience. Varies by audience, creative, and season (spikes Nov-Dec). | | **CTR** (unique outbound) | % of impressions that clicked through to your site | Use unique outbound: one click per person, only counts clicks leaving the platform. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 8-results.md (reported line 32)May include surrounding context.
md
| ------------------------- | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **CPM** | Cost per 1,000 impressions | Baseline ad cost. Higher = more competitive/expensive audience. Varies by audience, creative, and season (spikes Nov-Dec). | | **CTR** (unique outbound) | % of impressions that clicked through to your site | Use unique outbound: one click per person, only counts clicks leaving the platform. | | **CPC** | Cost per unique outbound click | Derived from CPM and CTR. | | **Frequency** | Average times each person saw your ad | Under 2 is fine. Above 3-4 signals creative fatigue: people start ignoring familiar ads. | | **Hook Rate** | % who watched first 3 seconds of video | Custom metric: 3-second video plays / impressions. Measures if your video catches attention. Only relevant for real video ads, not static-image videos. | | **Conversion Rate** | % of landing page visitors who purchased | Custom metric: purchases / landing page views. Measures landing page and offer effectiveness. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 8-results.md (reported line 58)May include surrounding context.
md
### Symptom-Cause-Action Table | Symptom | Likely Cause | Action | | ----------------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | No sales + low CTR + low CPM | Ad not appealing to audience. Cheap impressions but nobody clicks. | Test new creative. Try different audience. Honestly evaluate if the product has demand. | | No sales + high CTR + low CPM | Landing page problem. People click (ad works) but don't convert after. | Install session recording (Hotjar/Clarity) to watch real user behavior. Make a test purchase in production to verify nothing is broken. Improve landing page copy, speed, or design. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 8-results.md (reported line 60)May include surrounding context.
md
| Symptom | Likely Cause | Action | | ----------------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | No sales + low CTR + low CPM | Ad not appealing to audience. Cheap impressions but nobody clicks. | Test new creative. Try different audience. Honestly evaluate if the product has demand. | | No sales + high CTR + low CPM | Landing page problem. People click (ad works) but don't convert after. | Install session recording (Hotjar/Clarity) to watch real user behavior. Make a test purchase in production to verify nothing is broken. Improve landing page copy, speed, or design. | | No sales + high CTR + high CPM | Expensive audience clicking but not buying. | Check landing page first. If landing page is fine, the audience may be too niche or competitive: test broader targeting. | | High frequency (3+) + declining CTR | Creative fatigue. Audience has seen the ad too many times. | Launch new creatives. Expand or change audience. |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide recommends installing session-recording tools to observe user behavior, but it does so without any caution about consent, privacy disclosures, masking sensitive fields, or compliance obligations. In an ads/checkout troubleshooting context, these tools can capture highly sensitive browsing and purchase-flow data, increasing the risk of privacy violations or accidental collection of personal or payment-related information.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 8-results.md (reported line 63)May include surrounding context.
md
| No sales + low CTR + low CPM | Ad not appealing to audience. Cheap impressions but nobody clicks. | Test new creative. Try different audience. Honestly evaluate if the product has demand. | | No sales + high CTR + low CPM | Landing page problem. People click (ad works) but don't convert after. | Install session recording (Hotjar/Clarity) to watch real user behavior. Make a test purchase in production to verify nothing is broken. Improve landing page copy, speed, or design. | | No sales + high CTR + high CPM | Expensive audience clicking but not buying. | Check landing page first. If landing page is fine, the audience may be too niche or competitive: test broader targeting. | | High frequency (3+) + declining CTR | Creative fatigue. Audience has seen the ad too many times. | Launch new creatives. Expand or change audience. | | CPM dropping + CTR dropping | Platform exhausted retargeting pool, now showing to colder audiences. | Expected behavior. Monitor for 1-2 weeks. If results don't recover, launch creatives tailored to cold audiences (people unfamiliar with your brand). | | Rising cost per result over weeks | Audience exhaustion. Often one ad absorbs all budget and wears out. | Check if budget is concentrated on one ad. Cut exhausted ads. Launch new campaign with fresh creatives. | | Big drop-off between funnel steps | Broken or weak step in the funnel (e.g., checkout bug, slow page). | Investigate the specific step. Test the flow yourself. Fix technical issues before changing ads. ...[truncated 24 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · 8-results.md (reported line 66)May include surrounding context.
md
| High frequency (3+) + declining CTR | Creative fatigue. Audience has seen the ad too many times. | Launch new creatives. Expand or change audience. | | CPM dropping + CTR dropping | Platform exhausted retargeting pool, now showing to colder audiences. | Expected behavior. Monitor for 1-2 weeks. If results don't recover, launch creatives tailored to cold audiences (people unfamiliar with your brand). | | Rising cost per result over weeks | Audience exhaustion. Often one ad absorbs all budget and wears out. | Check if budget is concentrated on one ad. Cut exhausted ads. Launch new campaign with fresh creatives. | | Big drop-off between funnel steps | Broken or weak step in the funnel (e.g., checkout bug, slow page). | Investigate the specific step. Test the flow yourself. Fix technical issues before changing ads. | **If you see high CTR but no sales:** test the purchase flow yourself. Something might be broken. A working ad sending traffic to a broken checkout is the most expensive mistake in advertising.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Several listed triggers such as "how to run ads," "ad strategy," "ad creative," "campaign structure," and "ad budget" are generic marketing phrases that can apply to many ad platforms or general business discussions. Although the description narrows the skill to Meta, these triggers themselves are broad enough to overlap with common requests unrelated to Facebook or Instagram ads.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run an external CLI command (adkit status) and then prefer a third-party CLI for campaign execution. That expands the skill from advisory guidance into tool execution against the local environment and potentially a live advertising account, which can create unauthorized actions, leak environment details, or cause real-world spend if the agent follows it automatically.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.