Generate Facebook Ad Creative Variations

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

The skill appears to generate ad creative as described, but it asks for shell and filesystem access that its own workflow does not justify.

Review this skill before installing because it grants broader local access than ad creative generation needs. Prefer a version that removes Bash and Read unless you specifically expect it to inspect user-selected local assets or run local commands under clear user control.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool permissions that violate the principle of least privilege
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill declares unrestricted Bash and Read tool access even though its stated purpose is to generate Facebook advertising copy and image variations. Its documented workflow only requires clarifying campaign requirements, generating content, creating supporting assets, and refining the result. The explicitly listed APIs are chat and image_generation.

Bash can provide local command-execution capabilities, while Read can expose files available to the agent's runtime identity. Neither permission is shown to be necessary for the documented content-generation workflow. Granting these tools therefore expands the skill's authority beyond its legitimate operational requirements and violates the principle of least privilege.

No malicious command, file-reading instruction, or active exploitation payload is present in the audited file. Exploitation would require additional untrusted or unsafe instructions to influence the tool-enabled agent.

Attack Path

1. The skill is loaded with the declared Bash and Read permissions.
2. The agent processes attacker-controlled campaign text, retrieved content, or another untrusted contextual instruction.
3. That content attempts to redirect the agent into invoking one of the unnecessary tools.
4. If the agent follows the malicious instruction, Read could access files available to the process, or Bash could execute commands under the agent's operating-system identity.
5. The resulting data could be disclosed through the agent's response, or local resources could be modified within the runtime's permission boundary.

Impact Assessment

Successful exploitation could permit:

• Reading files accessible to the agent process, potentially includin ...[truncated 594 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Read from allowed-tools because they are not required by the documented advertising-content workflow.
2. Permit only the capabilities necessary for the skill's stated operation, specifically the approved chat and image-generation interfaces.
3. If user-provided assets must be read, grant access only to explicitly selected files or a dedicated sandbox directory rather than exposing general filesystem-reading capability.
4. If command execution becomes necessary in a future version, replace unrestricted shell access with a narrowly scoped tool that validates arguments, uses an allowlist of operations, and runs in a sandbox with minimal filesystem and network privileges.
5. Add automated validation that compares declared tools with documented workflow requirements and rejects unnecessary high-impact permissions during review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.