meta_ad

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can store Meta ad account credentials locally and create paid advertising objects, so users should review it carefully before use.

Install only if you are comfortable giving the skill a Meta access token for an advertising account. Use the least-privileged token available, keep ads PAUSED unless you intentionally want them active, verify budgets and targeting before running scripts, and protect, rotate, or delete the local credential file when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code persists highly sensitive secrets including the Meta access token and optional app secret to a predictable file under the user's home directory in plaintext, with no file permission hardening, encryption, or use of an OS credential store. If the host is multi-user, backed up, synced, inspected by malware, or the file is accidentally exposed, an attacker could steal credentials and take over ad operations or access connected Meta resources.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal