T08 · Insecure Dependencies
Error
- Location
references/ad-delivery.md:14- Finding
Unpinned Global Installation of a Privileged Third-Party CLI
- Content
View full analysis
- Remediation
View remediation
Security audit
lanbow-claw-skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is for running Meta ads and mostly discloses that, but it asks users to share powerful ad-account credentials and install an unpinned global CLI, so it needs Review before use.
Install only if you are comfortable giving an agent and the `lanbow-ads` CLI authority over Meta ad accounts. Use platform secret fields or environment variables, avoid pasting tokens or App Secrets into chat, use short-lived least-privilege tokens where possible, pin and verify the CLI before use, start with a test ad account and small budgets, and revoke or clean up credentials after the session.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/meta-account-setup.md:34- Finding
Insecure Delivery and Command-Line Handling of Meta Credentials
- Content
View full analysis
1. Open https://developers.facebook.com/tools/explorer/ > 2. In the top-right **App** dropdown, select your App (use the App ID from Step 2) > 3. Click **"Generate Access Token"** → select permissions: `ads_management`, `ads_read`, `business_management` > 4. Click **"Submit"** > 5. Copy the generated Access Token and send it to me ``` It then passes secrets as command-line arguments: ```bash # User provides Access Token → you run: lanbow-ads auth set-token # Only if user provides App Secret (optional) → you run: lanbow-ads config set --app-secret ``` Token exchange similarly places a token in an argument: ```bash lanbow-ads auth exchange --token ``` ### Technical Analysis Although the Skill recommends environment variables or platform secret fields, it explicitly permits access tokens and app secrets to be pasted into the conversation. This can expose secrets to conversation retention, agent traces, monitoring systems, support exports, or other platform-level telemetry. Passing secrets as command-line arguments creates an additional exposure surface. Depending on t ...[truncated 1954 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/meta-account-setup.md:213- Finding
Non-Expiring Administrative System User Exceeds Least-Privilege Requirements
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (44)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to ask users to provide Meta credentials directly if environment variables are not set, including an access token and potentially an app secret. Even though it prefers secret fields first, normalizing direct credential collection in-conversation materially increases the risk of secret disclosure, logging, retention in transcripts, and use in untrusted hosted environments.
- Content
text 2. **Ask the user to provide credentials directly (most common):** If env vars are not set, tell the user exactly how to get each credential from Meta's web interface. **Recommend the user use their platform's secret fields or environment variables rather than pasting credentials directly into chat.** If direct input is the only option, only request the minimum credentials needed for the current task: - **Access Token:** Open https://developers.facebook.com/tools/explorer/ → select your App → click "Generate Access Token" → select permissions `ads_management`, `ads_read`, `business_management` → click "Submit" → copy the token - **App ID:** Go to https://developers.facebook.com/apps/ → select your App → App Settings → Basic - **Ad Account ID:** Go to https://adsmanager.facebook.com/ → find `act_XXXXXXXXX` in the URL or account dropdown - **App Secret (only if needed for token exchange):** App Settings → Basic → click "Show" next to App Secret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md The agent is restricted to the following credential operations **only**: - `lanbow-ads config set --app-id` / `--app-secret` / `--account` — configure CLI - `lanbow-ads auth set-token` — set access token - `lanbow-ads auth exchange` — exchange short-lived token for long-lived token - `lanbow-ads auth status` — verify token validity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md The agent is restricted to the following credential operations **only**: - `lanbow-ads config set --app-id` / `--app-secret` / `--account` — configure CLI - `lanbow-ads auth set-token` — set access token - `lanbow-ads auth exchange` — exchange short-lived token for long-lived token - `lanbow-ads auth status` — verify token validity
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md All sub-skill instructions and reference materials are self-contained in `references/`. ### Feature 1: Strategy Research - **[strategy-research.md](references/strategy-research.md)** — Full strategy research system, research protocol, chapter-based output rules - **[strategy-template.md](references/strategy-template.md)** — Report section structure (Executive Summary → Controls) - **[strategy-meta-only-template.md](references/strategy-meta-only-template.md)** — Meta-only campaign strategy template - **[strategy-document-standards.md](references/strategy-document-standards.md)** — Report formatting standards, table numbering, data source annotations
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This section explicitly tells the agent to ask the user for an Access Token, App ID, and Ad Account ID directly, which is credential collection behavior. In context, this is more dangerous because the skill is operational and can immediately use the supplied token to manage live Meta ad accounts, creating risk of account compromise, unauthorized spend, and sensitive token exposure in conversation history or logs.
- Content
[ -n "$META_APP_SECRET" ] && lanbow-ads config set --app-secret "$META_APP_SECRET"
text 2. **User provides credentials directly:** Ask the user for their Access Token, App ID, and Ad Account ID (minimum needed). Only request App Secret if the user needs token exchange. Recommend the user provide credentials via env vars or platform secret fields rather than pasting into chat. The user gets tokens from Meta's web interface (Graph API Explorer or Business Settings). 3. **`lanbow-ads auth login` (rarely works):** This opens a local browser for OAuth. It only works when you and the user are on the **same machine**. Do NOT attempt this by default — if the user can't open the auth URL, it means you're on different machines. Fall back to method 2 immediately instead of sending auth URLs the user cannot use.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Documenting a global
--access-tokenflag encourages passing secrets on the command line, where they may be exposed through shell history, process listings, job logs, or audit trails. Although this is a common CLI pattern, in a hosted agent setting it materially increases the risk of credential leakage compared with using preconfigured secure storage.- Content
md | `--format <format>` | Output format: `table` or `json` | | `--verbose` | Enable verbose logging | | `--account <id>` | Ad account ID or alias (overrides default) | | `--access-token <token>` | Access token (overrides stored token) | Default account is auto-injected when configured via `lanbow-ads config set --account act_XXXXX`.
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Text-only (no product image):
bash curl -s "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent" \ -H "x-goog-api-key: ${GEMINI_API_KEY}" \ -H "Content-Type: application/json" \ -d '{
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Without product image:
bash curl -s "https://generativelanguage.googleapis.com/v1beta/models/gemini-3.1-flash-image-preview:generateContent" \ -H "x-goog-api-key: ${GEMINI_API_KEY}" \ -H "Content-Type: application/json" \ -d '{
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Path | Token Type | Validity | Best For | |------|-----------|----------|----------| | **Quick Start (recommended for new users)** | User Access Token via OAuth | ~1-2 hours (short-lived) or ~60 days (long-lived) | Get ads running fast, minimal setup | | **Production Setup** | System User Token | Never expires | Long-running automation, team/agency use | **Start with Quick Start.** You can upgrade to a System User Token later without recreating campaigns.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This line instructs the agent to ask the user to provide credentials directly, including an access token, creating a credential collection workflow through conversation. Even though the text mentions using env vars or secret fields when possible, it still endorses direct credential submission as a common path, which increases exposure in logs, transcripts, and intermediary systems.
- Content
md **2. Ask the user to provide credentials directly (most common):** If env vars are not set, ask the user for their Access Token, App ID, and Ad Account ID. **Only request the minimum credentials needed for the current task.** Tell the user exactly how to get each value — don't just ask, give them step-by-step instructions they can follow in their browser. **Recommend the user use environment variables or their platform's secret fields rather than pasting credentials into chat.** If direct input is the only option, proceed with the instructions below.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This section begins a procedure for obtaining and transmitting an access token to the agent. Because access tokens are bearer secrets, collecting them through chat can allow anyone with transcript access to impersonate the user against Meta APIs.
- Content
md **Recommend the user use environment variables or their platform's secret fields rather than pasting credentials into chat.** If direct input is the only option, proceed with the instructions below. **To get an Access Token, tell the user:** > You can get an Access Token yourself: > 1. Open https://developers.facebook.com/tools/explorer/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **To get an Access Token, tell the user:** > You can get an Access Token yourself: > 1. Open https://developers.facebook.com/tools/explorer/ > 2. In the top-right **App** dropdown, select your App (use the App ID from Step 2) > 3. Click **"Generate Access Token"** → select permissions: `ads_management`, `ads_read`, `business_management`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **To get an Access Token, tell the user:** > You can get an Access Token yourself: > 1. Open https://developers.facebook.com/tools/explorer/ > 2. In the top-right **App** dropdown, select your App (use the App ID from Step 2) > 3. Click **"Generate Access Token"** → select permissions: `ads_management`, `ads_read`, `business_management`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **To get an Access Token, tell the user:** > You can get an Access Token yourself: > 1. Open https://developers.facebook.com/tools/explorer/ > 2. In the top-right **App** dropdown, select your App (use the App ID from Step 2) > 3. Click **"Generate Access Token"** → select permissions: `ads_management`, `ads_read`, `business_management`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The explicit instruction to copy the generated access token and send it to the agent is a direct request for a sensitive bearer credential. In the context of an advertising automation skill, compromise of this token could enable campaign changes, billing-impacting actions, data access, and further token exchange operations depending on scopes.
- Content
md > You can get an Access Token yourself: > 1. Open https://developers.facebook.com/tools/explorer/ > 2. In the top-right **App** dropdown, select your App (use the App ID from Step 2) > 3. Click **"Generate Access Token"** → select permissions: `ads_management`, `ads_read`, `business_management` > 4. Click **"Submit"** > 5. Copy the generated Access Token and send it to me
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide tells the user how to reveal and share the Meta App Secret, which is a long-lived sensitive secret with broader abuse potential than a short-lived user token. Instructing users to transmit an app secret to the agent materially increases the chance of credential compromise, account takeover of API capabilities, and persistent unauthorized access.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This line operationalizes use of a user-supplied access token in the CLI after conversational collection, reinforcing an insecure credential handling pattern. While setting a token in the tool is expected, the surrounding workflow lacks a secure acquisition channel and thus turns this into a real exposure risk.
- Content
md # User provides App ID → you run: lanbow-ads config set --app-id <APP_ID> # User provides Access Token → you run: lanbow-ads auth set-token <ACCESS_TOKEN> # User provides Ad Account ID → you run:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The guide states that the user needs to generate a token and paste it to the agent, directly endorsing insecure transmission of a bearer credential. Because this skill orchestrates ad lifecycle operations, the token likely carries permissions capable of changing campaigns and accessing business assets.
- Content
md 1. In the left menu, click **Add Product** (or scroll down on the app Dashboard) 2. Find **Marketing API** and click **Set Up** ## Step 3: Get an Access Token The user needs to generate a token in their browser and paste it to you. There are two ways:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This instruction asks the user to provide both App Secret and Access Token so the agent can configure the CLI, combining multiple powerful credentials in one conversational workflow. In this context, exposure could permit long-lived unauthorized API access, token exchange, and broad manipulation of advertising assets and associated business data.
- Content
Step 4: Configure the CLI
Once the user provides their App ID, App Secret, and Access Token, run:
bash lanbow-ads config set --app-id <APP_ID> --app-secret <APP_SECRET>
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- references/creative-generation.md:120