meta-ad-creative
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates as described, using professional marketing frameworks to generate ad copy and creatives. It interacts with the Appeeky API for image generation and listing analysis.
- [DATA_EXPOSURE]: The skill reads from local marketing context files (
app-ads-context.md,app-marketing-context.md) and accepts external URLs (App Store/Google Play). This data is used to inform the ad creative process and is sent to the vendor's API endpoints (/v1/app-ad-creatives/generate). This behavior is consistent with the skill's primary purpose and involves trusted store domains. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external app store listings. While this introduces a surface for indirect prompt injection (e.g., malicious store descriptions attempting to influence the agent), the risk is low due to the lack of high-privilege capabilities and the workflow's built-in confirmation step requiring user review of the analysis before creative generation.
- Ingestion points: Store listing content via
app_url(Step 2 and Step 3). - Boundary markers: Absent in instructions.
- Capability inventory: Generates text and images via API; no shell execution or sensitive file writes.
- Sanitization: Absent in instructions.
Audit Metadata