Generate Facebook Ad Creative Variations

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:22 AM UTC
• Version: 1.0.0

Overview

The skill is a simple Facebook ad creative generator, but it requests broad shell and file-reading tools that are not needed for that purpose.

Review this skill before installing. Its advertised function is ordinary ad-creative generation, but it should not need shell command or broad local file access; use it only in a constrained environment or after removing those permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Excessive Runtime Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Excessive tool permissions that violate least privilege
Risk Level: Medium

Vulnerable Code:

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill declares access to both Bash and Read, although its documented purpose is limited to generating and refining Facebook advertising copy and images. The workflow does not identify any legitimate requirement to execute shell commands or read arbitrary local files.

This creates an unnecessary privilege boundary expansion. If attacker-controlled content, prompt injection, or a future modification to the skill instructions induces the agent to invoke these tools, Read could expose locally accessible files and Bash could execute commands with the privileges of the agent process.

The reviewed files contain no direct shell invocation, malicious command, credential theft, persistence mechanism, or data-exfiltration instruction. Exploitation therefore depends on the tool-enabled agent following additional malicious or compromised instructions.

Attack Path

1. The skill is loaded and grants the agent the unnecessary Bash and Read capabilities.
2. The agent subsequently processes attacker-controlled advertising content or other untrusted instructions containing a prompt-injection payload.
3. The payload directs the agent to inspect local files using Read or execute commands using Bash.
4. If the agent follows the injected instructions and the surrounding runtime lacks adequate approval or sandbox controls, operations execute within the permissions of the agent process.
5. Accessible local information could be disclosed through generated output, or shell commands could alter resources available to that process.

Impact Assessment

Successful exploitation could provide access to files readable by the agent process and command execution under that process ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash and Read from allowed-tools because neither capability is required by the documented content-generation workflow.
• Permit only the narrowly scoped chat and image-generation interfaces needed to produce the advertised output.
• If file input becomes necessary, introduce a restricted file-reading capability limited to explicit user-selected files rather than arbitrary filesystem access.
• Require explicit user confirmation before any command execution or sensitive-file access.
• Run the skill in a sandbox with minimal filesystem, process, credential, and network access.
• Treat advertising briefs and all externally supplied content as untrusted input, and prevent such content from authorizing tool calls or overriding system and skill constraints.
• Document every required tool and its precise operational purpose so future permission changes can be reviewed against least-privilege requirements.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.