T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:24- Finding
Exposure of Meta API credentials through URL query parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Meta Ads
Security checks for vulnerabilities and agentic risk
Overview
This Meta Ads skill is coherent documentation for managing ads, but it encourages broad, long-lived Meta ad-management access and destructive operations without enough safeguards.
Review this skill carefully before installing. Use it only with a narrowly scoped Meta credential, avoid query-string tokens, keep tokens in a secret manager, separate read-only from management use, and require explicit human approval before activating, budget-changing, or deleting ad assets.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skill.md:586- Finding
Recommendation of non-expiring administrative credentials violates least privilege
- Content
View full analysis
Users > System Users 2. Create a new System User with "Admin" role 3. Assign the ad account to the System User 4. Generate a token with `ads_read` and `ads_management` permissions System User tokens do not expire. ``` ### Technical Analysis The Skill recommends creating an `Admin` system user with both read and management permissions and using a token described as non-expiring. This combines broad privileges with an indefinite credential lifetime. The documented Skill supports destructive and financially consequential actions, including activating campaigns, changing budgets, and deleting campaigns, ad sets, and ads. An administrative, non-expiring token therefore creates a larger and longer-lasting compromise window than a narrowly scoped, rotated credential. The documentation does not establish that the Admin role is necessary for all supported operations, distinguish read-only deployments from management deployments, or require periodic rotation and explicit safeguards for high-impact actions. ### Attack Path 1. An operator follows the documentation and creates an Admin system user. 2. The operator generates a non-expiring token with `ads_read` and `ads_management`. 3. The token is stored in an environment file, automation system, shell history, log, or another accessible location. 4. An attacker obtains the token through host compromise, accidental disclosure, insecure logging, or the query-string practices documented elsewhere in the file. 5. The attacker uses the token to access ...[truncated 1018 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Environment Variables - `META_ACCESS_TOKEN` - Meta access token (User Access Token or System User Token) - `META_AD_ACCOUNT_ID` - Your ad account ID (numeric, without `act_` prefix) ### Required Permissions
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Environment Variables - `META_ACCESS_TOKEN` - Meta access token (User Access Token or System User Token) - `META_AD_ACCOUNT_ID` - Your ad account ID (numeric, without `act_` prefix) ### Required Permissions
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Environment Variables - `META_ACCESS_TOKEN` - Meta access token (User Access Token or System User Token) - `META_AD_ACCOUNT_ID` - Your ad account ID (numeric, without `act_` prefix) ### Required Permissions
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Environment Variables - `META_ACCESS_TOKEN` - Meta access token (User Access Token or System User Token) - `META_AD_ACCOUNT_ID` - Your ad account ID (numeric, without `act_` prefix) ### Required Permissions
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Token Management ### Extending User Access Tokens Short-lived user tokens (~2 hours) can be exchanged for long-lived tokens (60-90 days):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill instructs users to supply a Meta access token, including potentially non-expiring system user tokens, but provides no warning about secure storage, leakage risks, or least-privilege handling. Long-lived ad-management credentials can enable unauthorized reads, writes, and deletions if exposed.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get Ad Account Info
bash curl "https://graph.facebook.com/v25.0/act_$META_AD_ACCOUNT_ID?fields=name,account_status,currency,timezone_name,amount_spent" \ -H "Authorization: Bearer $META_ACCESS_TOKEN"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents a destructive campaign deletion operation without any warning, confirmation guidance, or mention of irreversible business impact. In an agent context, this increases the chance that a user or automated workflow could delete live advertising assets unintentionally, causing service disruption and financial loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The ad set delete example enables destructive modification of production advertising configuration without safety guidance. Because ad sets control targeting and budgets, accidental or automated deletion can interrupt campaigns and create operational and financial consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill presents ad deletion as a normal operation without warning about destructive effects on active delivery, auditability, and campaign continuity. In a tool used by agents, omission of safeguards can make unintended destructive actions more likely.
- Content
Static analysis
No suspicious patterns detected.