T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config_manager.py:11- Finding
Plaintext Storage and Visible Entry of Meta Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
meta_ad
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-aligned for Meta ad automation, but it handles high-impact ad-account credentials in an unsafe plaintext way that users should review before installing.
Install only if you are comfortable giving this skill a Meta access token capable of managing ads. Use a least-privilege token, avoid entering credentials while screen sharing or recording, do not provide the optional App Secret unless truly needed, and delete or protect ~/.workbuddy/meta_ads_config.json after use. Review all generated campaigns in Meta Ads Manager before activating them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The description claims a streamlined workflow that handles campaign setup, audience targeting, media upload, and ad creation. This code chunk only supports creating an ad from a provided adset_id and creative object, plus helper logic for assembling creative payloads and listing CTA options. It assumes prerequisites already exist, such as an ad set, page, and uploaded image/video identifiers. There is no logic for creating campaigns, defining audiences/targeting, or uploading media assets. Therefore, the declared description overstates the implemented capabilities of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description promises a streamlined workflow for creating Meta ads programmatically, including campaign setup, targeting, media upload, and ad creation. However, the supplied code only defines generic GET/POST request helpers and concrete functions for reading ad account information and listing campaigns, plus token validation. Although a generic POST helper exists, there is no implemented logic for creating campaigns, ad sets, creatives, uploads, or ads. Therefore the actual code materially underdelivers relative to the declared primary purpose, making this a description/behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
This section explicitly lists sensitive items to provide to the skill, including Access Token and App Secret, without any safeguards or warnings about secure input and storage. In the context of an ad-automation skill with network access, exposed credentials could enable unauthorized campaign management, data access, and financial abuse of the linked ad account.
- Content
text 需要的信息： - **Access Token**: Meta API 访问令牌 - **Ad Account ID**: 广告账户 ID (格式: act_123456789) - **App ID** (可选): 应用 ID - **App Secret** (可选): 应用密钥
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
认证
所有请求需要 Access Token:
text Authorization: Bearer {ACCESS_TOKEN}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md #!/usr/bin/env python3 """ Meta Ads Creator - 配置管理模块 管理 Access Token、广告账户 ID 等配置 """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Meta Ads Creator - 配置管理模块 管理 Access Token、广告账户 ID 等配置 """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Meta Ads Creator - 配置管理模块 管理 Access Token、广告账户 ID 等配置 """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Meta Ads Creator - 配置管理模块 管理 Access Token、广告账户 ID 等配置 """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Meta Ads Creator - 配置管理模块 管理 Access Token、广告账户 ID 等配置 """ import json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Meta Ads Creator - 配置管理模块 管理 Access Token、广告账户 ID 等配置 """ import json
Tainted flow: 'files' from open (line 75, file read) → requests.post (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python if name: data['name'] = name response = requests.post(url, files=files, data=data) response.raise_for_status() result = response.json()
Tainted flow: 'files' from open (line 75, file read) → requests.post (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python if name: data['name'] = name response = requests.post(url, files=files, data=data) response.raise_for_status() result = response.json()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill documents and invokes scripts that read local files, write configuration, and make network calls to the Meta Marketing API, but it does not declare any explicit tool scope such as allowed-tools or permissions. This increases the risk of overbroad execution in environments that rely on manifest scoping, because users and platforms cannot easily tell what capabilities the skill expects before running it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation instructs users to handle highly sensitive credentials including Meta access tokens and app secrets, but it does not warn against exposing them in logs, examples, shared config files, or source control. In a skill centered on API automation, missing credential-handling guidance materially raises the chance of accidental token leakage and subsequent account or ad-spend abuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation explicitly recommends passing the access token as a URL query parameter without any warning. Tokens in URLs are commonly exposed via logs, browser history, reverse proxies, analytics systems, and referrer leakage, which can lead to unauthorized access to the Meta ad account and campaign management APIs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
User-facing docstrings, prompts, and status messages are written in Chinese throughout the file, which imposes a specific language experience. There is no indication that language is configurable or that the skill is intentionally limited to a Chinese-speaking context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes highly sensitive secrets including the Meta access token and optional app secret to a local JSON file in plaintext under the user's home directory. Any other local user, process, backup system, or malware with access to that file can recover those credentials and use them to access or abuse the advertising account.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstrings, CLI usage text, and user-facing output are entirely in Chinese, which imposes a specific language on users. The file does not indicate that this is a region-specific tool or provide any opt-in or alternative language support.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file forces a specific language for docstrings and user-facing CLI output without offering an alternative or documenting that the tool is intentionally region/language-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file’s user-facing natural language, including the module description, argument help, usage output, and status messages, is exclusively Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings, docstrings, and CLI usage text that force a specific language experience. Under the policy, language constraints should be optional or explicitly justified; here there is no opt-in, fallback, or explanation that the skill is intended only for Chinese-speaking users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The module accesses a sensitive credential via get_access_token() and injects it into an Authorization header, but there is no warning, comment, or documentation in this file explaining that credentials are being consumed and sent to an external API. Under the rule, sensitive environment variables or credentials should have some form of disclosure unless already clearly documented elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code performs outbound requests to the Meta Graph API using account identifiers, access tokens, and request parameters, but the general GET/POST helpers provide no user-facing disclosure, confirmation, or explanatory comment about transmitting data to an external service. The later print statements only appear in the test harness and do not warn callers using these functions as a library.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code reads a local file and sends it, along with an access token, to a remote Meta API endpoint. While the module docstrings describe uploading, the upload functions themselves provide no user-facing warning, confirmation, or logging that local media and credentials are being transmitted over the network.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The video upload path sends a local video file and access token to the Meta API, but unlike the batch image path it has no user-facing print, prompt, or warning around this network action. This is a safety-relevant operation involving user data transmission and credential use.
- Content