Meta Ads Report Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:35 PM UTC
• Version: 1.0.0

Overview

This skill reads a user-provided Meta Ads token to fetch ad performance reports, and the reviewed behavior matches that stated purpose.

Install only if you are comfortable giving the skill read access to Meta advertising insights for the configured ad account. Store META_ACCESS_TOKEN outside source control, use the minimum listed scopes, rotate or revoke the token if exposed, and prefer pinned dependency versions or a lockfile before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–3
Vulnerability Type: Unpinned dependencies and mutable package resolution
Risk Level: Medium

Vulnerable Code

text

facebook_business
python-dotenv
urllib3<2

Technical Analysis

The project does not pin any dependency to an exact, reviewed version and does not provide package hashes. The urllib3<2 constraint is only an upper bound and can still resolve to different releases over time.

Consequently, identical installation commands may install unreviewed package versions. These dependencies execute in the same Python process that loads META_ACCESS_TOKEN and META_AD_ACCOUNT_ID. A compromised dependency release or package-distribution channel could therefore read those credentials, intercept Meta API data, modify reports, or execute arbitrary code with the privileges of the Skill process.

No malicious dependency was identified in the reviewed files; the confirmed weakness is the absence of immutable dependency pinning and integrity verification.

Attack Path

1. An attacker compromises a permitted dependency release or its distribution channel.
2. A user installs the project after the compromised release becomes eligible under the mutable requirements.
3. Python imports the affected package when main.py or meta_event_list.py runs.
4. Malicious initialization code executes with the permissions of the Skill process.
5. The malicious code reads environment variables containing the Meta access token and ad account ID, accesses retrieved advertising data, or performs other actions available to that process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the Skill process account. The resulting scope may include:

• Theft of the Meta access token and ad account identifier.
• Unauthorized access to advertising insights within the token’s granted permissions.
• Exposure of ad-set names, spending, conversion cou ...[truncated 337 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version.
2. Generate and commit a lock file containing resolved transitive dependencies.
3. Require cryptographic hashes during installation, such as with a hash-enabled requirements file produced by pip-compile --generate-hashes.
4. Install dependencies with pip install --require-hashes -r requirements.txt.
5. Review and test dependency updates before changing the lock file.
6. Add automated dependency vulnerability and provenance scanning to CI.
7. Run the Skill with minimal filesystem and network permissions and retain only the documented Meta permissions.
8. Keep the Meta token out of source control and rotate it immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md

## 🛠️ Setup Guide

To use this skill, you need to get your **Access Token** and **Ad Account ID** and save them in your `.env` file.

### Step 1: Get Access Token
1.  Go to [Meta for Developers - Graph API Explorer](https://developers.facebook.com/tools/explorer/).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md

## 🛠️ Setup Guide

To use this skill, you need to get your **Access Token** and **Ad Account ID** and save them in your `.env` file.

### Step 1: Get Access Token
1.  Go to [Meta for Developers - Graph API Explorer](https://developers.facebook.com/tools/explorer/).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

md

## 🛠️ Setup Guide

To use this skill, you need to get your **Access Token** and **Ad Account ID** and save them in your `.env` file.

### Step 1: Get Access Token
1.  Go to [Meta for Developers - Graph API Explorer](https://developers.facebook.com/tools/explorer/).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

## 🛠️ Setup Guide

To use this skill, you need to get your **Access Token** and **Ad Account ID** and save them in your `.env` file.

### Step 1: Get Access Token
1.  Go to [Meta for Developers - Graph API Explorer](https://developers.facebook.com/tools/explorer/).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

## 🛠️ Setup Guide

To use this skill, you need to get your **Access Token** and **Ad Account ID** and save them in your `.env` file.

### Step 1: Get Access Token
1.  Go to [Meta for Developers - Graph API Explorer](https://developers.facebook.com/tools/explorer/).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The documentation explicitly instructs the user to generate an access token with ads-related permissions and copy the token string, but it does not warn against sharing that token in chat logs, prompts, screenshots, or insecure storage. Because access tokens grant direct API access to advertising insights, this omission can lead to accidental credential disclosure and unauthorized access to business-sensitive ad performance data.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

1.  Go to [Meta Graph API Explorer](https://developers.facebook.com/tools/explorer/).
2.  Select your App.
3.  Add Permissions: `ads_read`, `read_insights`.
4.  Click **Generate Access Token** and copy the string.

### 2. Get Ad Account ID
1.  Go to [Facebook Ads Manager](https://adsmanager.facebook.com/).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · main.py (reported line 71)May include surrounding context.

python

return f"⚠️ Ads ran yesterday, but no conversion actions were recorded."

            # Generate list
            result_lines = [f"📋 **Available Events (from {date_str})**", "Copy the 'Action Type' below to your .env file.\n"]
            
            for action in actions:
                a_type = action.get('action_type')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · meta_event_list.py (reported line 56)May include surrounding context.

python

return f"⚠️ Ads ran yesterday, but no conversion actions were recorded."

            # Generate list
            result_lines = [f"📋 **Available Events (from {date_str})**", "Copy the 'Action Type' below to your .env file.\n"]
            
            for action in actions:
                a_type = action.get('action_type')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to place a sensitive Meta access token in a local .env file but provides no guidance about secret handling, token lifetime, least privilege, rotation, or preventing accidental commit to version control. While storing secrets in environment configuration is common, omitting basic security warnings in setup documentation increases the chance of credential leakage and unauthorized access to ad account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill asks users to configure a Meta access token and ad account identifier for ad analytics access but provides no warning about the sensitivity of those credentials or the business data exposed through them. Even though this is documentation rather than executable exfiltration logic, normalizing token entry without privacy, scope, storage, or rotation guidance increases the chance of credential misuse and unintended exposure of advertising/account data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The comment explicitly states 'English & Korean support for convenience', and the date parser only recognizes English and Korean date phrases. This imposes a locale-specific behavior without offering user choice or documenting that the skill is intentionally limited to those languages.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency facebook_business is unpinned, so installs may resolve to different versions over time, including versions with breaking changes or newly introduced vulnerabilities. This weakens supply-chain integrity and makes builds non-reproducible, which can expose the skill to accidental insecure upgrades.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

facebook_business
python-dotenv
urllib3<2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

python-dotenv is unpinned and also has known advisories in some releases, so the environment may install an affected version without visibility. Because this library can read and write .env files, using a vulnerable release could lead to unsafe file handling or configuration compromise depending on how the skill uses it.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

facebook_business
python-dotenv
urllib3<2

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The manifest does not pin python-dotenv, so it is impossible to verify whether the installed version includes fixes for known advisories such as symlink-following and file overwrite issues. If an affected version is installed and the skill manipulates .env files in a writable or attacker-influenced path, this could enable unauthorized file modification or environment poisoning.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: urllib3 has 16 known advisory(ies) (CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Although urllib3<2 constrains the major version, it still permits a wide range of releases, including potentially vulnerable ones, and prevents verification against numerous published advisories. Because urllib3 is a core HTTP client component, affected versions can expose the skill to request-handling, proxy-header leakage, or decompression-related issues depending on network usage.

Content

No source excerpt is available for this finding.