meta-ads-subagent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:33 AM UTC
• Version: 1.0.3

Overview

This Meta Ads automation skill is not clearly malicious, but it needs Review because it asks users to expose powerful ad-account tokens in chat and gives the agent broad business, local-system, and network authority.

Install only after tightening operational controls. Do not paste Meta or Habilis tokens into chat; configure them through a secure local secret mechanism, restrict tokens to the minimum scopes and accounts needed, enable dry-run or manual approval for pauses and campaign changes, avoid all-account sweeps and cron prompt searches unless explicitly authorized, and run URL health checks through a constrained validator or sandboxed egress path.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:103

Finding

Unsafe Collection and Plaintext Persistence of Meta Access Tokens

Content

View full analysis

`) e `~/.hermes/config.yaml` em `mcp_servers.meta-ads.env.META_ACCESS_TOKEN`. - **Recarregar Processo MCP:** Executar `pkill -f mcp-meta-ads` para encerrar workers antigos e permitir que o Hermes instancie processos com o novo token. ``` ### Technical Analysis The Skill explicitly invites users to submit a privileged Meta access token through the chat and states that the token will be saved. It also directs the agent to persist the same secret in plaintext `.env` and YAML configuration files. A Meta token carrying `ads_management`, `ads_read`, and page-related permissions is a high-value credential. Chat transcripts may be retained in conversation history, telemetry, debug output, or provider-side logs. Plaintext configuration files may also be readable through backups, support bundles, accidental repository commits, overly broad filesystem permissions, or other processes running under the same user. Storing the token in multiple files increases the number of copies that must be secured and revoked. The behavior also weakens the README's broad claim that access tokens remain exclusively local under a “Zero-Storage” model: although the referenced architecture prohibits server-side st ...[truncated 1285 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:211

Finding

Broad Process Termination Through Pattern-Based pkill

Content

View full analysis

`) e `~/.hermes/config.yaml` em `mcp_servers.meta-ads.env.META_ACCESS_TOKEN`. - **Recarregar Processo MCP:** Executar `pkill -f mcp-meta-ads` para encerrar workers antigos e permitir que o Hermes instancie processos com o novo token. ``` ### Technical Analysis `pkill -f mcp-meta-ads` matches the supplied expression against complete process command lines. It is not restricted to a PID created by this Skill, a particular executable path, a service unit, or a single process owner. Consequently, the command can terminate every accessible process whose command line contains `mcp-meta-ads`, including unrelated workers, another user's session where permissions allow it, diagnostic commands, or concurrently running jobs. Process termination is broader than necessary to reload one managed MCP worker. Although the command does not itself escalate operating-system privileges, it violates least-privilege principles by directing the agent to exercise process-control authority beyond a uniquely identified worker. ### Attack Path 1. A token-expiration or token-update event triggers the documented reload procedure. 2. The agent executes `pkill -f mcp-meta-ads`. 3. The operating system identifies all accessible processes with matching command lines. 4. Multiple workers or unrelated matching processes are terminated. 5. Active requests, audits, campaign operations, or other users' MCP sessions are interrupted. An attacker able to influence a local command line could also include the matching text in a target process's arguments, making that process eligi ...[truncated 518 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:161

Finding

Unnecessarily Broad Enumeration of Accounts and Agent Operational State

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:225

Finding

Server-Side Request Forgery Risk in Automated Landing-Page Validation

Content

View full analysis

` ``` ```bash curl -sIL -o /dev/null -w "%{http_code} %{url_effective}\n" ``` ```text 9. **Teste de Landing Pages em Lote (curl multi-URL):** - O `curl -sIL` aceita múltiplas URLs em sequência na mesma chamada de terminal. Use para testar vários destinos de uma vez: ``` ```bash curl -sIL -o /dev/null -w "%{http_code} %{url_effective}\n" "https://url1" "https://url2" "https://url3" ``` ```text - **Acesso HTTP vs HTTPS por IP:** Requisição direta via IP cru deve ser feita via HTTP (`http:///metaads.html`). Para HTTPS, utilize o domínio configurado (`https://xvix.com.br`). ``` ### Technical Analysis The Skill extracts URLs from remotely controlled advertisement fields, including free-form creative body text and shortened or affiliate links, and passes them to `curl`. The `-L` option follows redirects. No controls are specified for: - Allowed URL schemes. - Loopback, private, link-local, multicast, or reserved IP addresses. - Cloud instance metadata addresses. - DNS rebinding. - Redirect destinations. - Request timeouts or maximum redirects. - Response size and connection limits. - Isolation from internal services. Even though `-I` generally requests headers rather than full response bodies, it still establishes outbound connections and can invo ...[truncated 1810 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

🚀 Quick Onboarding & First-Time Setup

1. Get your Habilis MCP Token:
   • Access the developer portal at https://xvix.com.br to generate your access token.
2. Configure Environment Variables:

   bash

   export HABILIS_API_KEY="hab_live_..."
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

md

- 📊 **3-Level Taxonomy**: Structured naming for Campaigns, Ad Sets, and Ads for effortless tracking.
- 🎨 **1080x1080 Creative Generator**: Autonomous SVG banner generation and asset uploads.
- 🛑 **Autonomous CPA Guardrails**: Automatically pauses underperforming ads exceeding CPA thresholds.
- 🔒 **Zero-Storage Security**: Meta access tokens remain exclusively on the client machine.

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

- [ ] **1. Habilis MCP Token (Obrigatório)**:
  - Obtenha seu token de acesso no portal de desenvolvedores: [https://xvix.com.br](https://xvix.com.br).
  - Defina: `export HABILIS_API_KEY="hab_live_..."`
- [ ] **2. Meta Ads Access Token (Cliente)**:
  - Token de usuário do sistema ou Graph API com escopo `ads_management` (reside estritamente no seu ambiente local).
  - Defina: `export META_ACCESS_TOKEN="EAA..."`
- [ ] **3. ID da Conta de Anúncios (`META_AD_ACCOUNT_ID`)**:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding text explicitly invites the user to paste a Meta access token into chat without a strong warning against secret sharing. Chat channels are often logged, retained, or exposed to broader system components, so encouraging token submission through chat materially increases credential disclosure risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill not only asks for access tokens in chat but states that the assistant can save and validate them, normalizing secret handling through the conversational interface. This is dangerous because it encourages insecure credential collection, potential persistence of secrets, and downstream misuse if logs, transcripts, or integrations are compromised.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · references/habilis_saas_architecture_and_zero_storage.md (reported line 15)May include surrounding context.

md

- Ao construir ou estender fluxos de Onboarding, parametrização ou exportação de credenciais no frontend do Habilis (`src/components/SkillDownloaderModal.tsx`, `src/lib/onboarding-schema.ts`, etc.):
  1. **Zero Persistência no Backend**: Tokens de acesso, senhas de API, IDs de conta de anúncios, Pixels e Page IDs digitados pelos clientes **NUNCA** devem ser gravados no banco de dados (`data/habilis_db.json`), SQLite, logs ou arquivos no servidor.
  2. **Processamento In-Memory**: O formulário opera exclusivamente em memória volátil do navegador via React State (`useState`).
  3. **Interpolação em Tempo Real**: Os snippets de código (`claude_desktop_config.json`, `.cursor/mcp.json`, comandos cURL, CLI do Hermes) e arquivos para download (`SKILL.md`, `.env`) são gerados client-side utilizando `Blob` e URLs temporárias (`URL.createObjectURL`), sendo liberados imediatamente após o download (`URL.revokeObjectURL`).
  4. **Avisos Transparentes de Segurança**: A interface do modal deve sempre exibir badges e alertas claros de privacidade (`🔒 Zero-Storage Guarantee`) para gerar confiança nos assinantes do SaaS.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises autonomous pausing of ads based on CPA thresholds, but it does not clearly warn users that the agent can make live, potentially revenue-affecting changes to production ad accounts. In a marketing automation skill, silent write actions against campaigns are risky because misconfiguration, bad metrics, or API errors can pause profitable ads and disrupt business operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase "meta ads" is extremely broad and likely to auto-activate the skill during ordinary discussion, not just when the user wants autonomous ad-management actions. Overbroad triggers are dangerous in powerful skills because they increase the risk of accidental invocation, unexpected data access, or unintended operational guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger "facebook ads" is a generic product reference that can collide with normal conversation and summon a high-privilege skill without sufficient user intent. In a skill that can audit accounts, inspect creatives, and pause ads, accidental activation meaningfully raises misuse risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger "otimizar tráfego" is vague and could match many benign marketing conversations unrelated to Meta Ads account access. Because the skill supports autonomous optimization and pausing ads, ambiguous activation increases the chance of unintended operational recommendations or actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill expands from Meta Ads management into CRM/GHL lead triage and conversation handling, creating unnecessary access to unrelated customer communications and PII. This violates least-privilege design and increases the chance that a Meta Ads-triggered invocation can read, classify, or act on CRM data beyond the user’s expected scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The directive to sweep all ad accounts available to the token and grep local cron outputs broadens data access far beyond a single account audit. This can expose unrelated client data, local artifacts, and operational history, creating cross-tenant privacy and confidentiality risk if the token or environment spans multiple accounts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs shell/process-management actions such as editing global config files and killing MCP processes, which exceeds normal ad-operations scope and enables host-level changes from an advertising workflow. Even if intended for troubleshooting, these actions increase the blast radius from a business task to local environment manipulation and could disrupt other services or alter credential state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README instructs users to configure API keys and Meta access tokens but does not prominently warn that these are sensitive credentials that must not be shared, logged, committed, or pasted into untrusted contexts. While the document does not itself exfiltrate secrets, normalizing token handling without security guidance increases the chance of accidental credential exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown guidance forces a specific language for core operational and security instructions. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; no such opt-in or justification appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document title and all instructional/descriptive content are written in Portuguese, but there is no natural-language indication that the skill supports other languages or that Portuguese is a required, justified locale. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents all instructions and examples in Portuguese, effectively forcing a specific language for users of the skill. Under the policy, a language constraint should either be optional for the user or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The comment block and visible placeholder labels such as 'PALAVRA_DESTAQUE' and 'Planos a partir de' indicate the template is fixed to Portuguese. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.