meta-ads-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to paste their Meta access token and then instructs storing and inserting that exact token into config/commands (e.g., .mcp.json and curl examples), which requires the LLM to receive and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow exposes an agent to outsider-authored free text via Meta API responses that include campaign/ad/audience/creative/insights fields rendered into tool outputs (e.g., names and descriptive fields) which the LLM consumes without filtering out attacker-controlled content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill sets up a dedicated MCP server that talks directly to the Meta Marketing API, requests an access token with ads_management, installs tools to create/update campaigns/adsets/ads, and even gives an example of creating a campaign with a $50/day budget. Those capabilities explicitly allow updating ad spend/budgets and performing actions that move money (ad spend) via the Meta API — i.e. direct financial execution.