meta-ads
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a standard implementation for managing Meta Ads via vendor-provided tools (Hyper MCP). It adheres to safety best practices by ensuring that all campaigns, ad sets, and ads are created with a 'PAUSED' status by default, preventing unauthorized live deployments.
- [EXTERNAL_DOWNLOADS]: The skill uses tools like
meta_business_upload_ad_imagewhich can ingest image assets from external URLs, andfirecrawltools to retrieve branding and screenshots from target websites. These operations are essential for the skill's primary purpose of ad creation and research. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites during the research phase, which represents a potential attack surface.
- Ingestion points: Website content and screenshots retrieved via
firecrawl_extract_brandingandfirecrawl_screenshot(Phase 1 in SKILL.md). - Boundary markers: No specific delimiters are used to wrap external content.
- Capability inventory: The skill possesses the ability to create and modify advertising campaigns and assets through the
meta_business_*toolset. - Sanitization: The skill employs a strong human-in-the-loop mitigation by requiring explicit user review of ad previews and a final manual activation step (
meta_business_update_campaign) before campaigns go live.
Audit Metadata