meta-ads

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a standard implementation for managing Meta Ads via vendor-provided tools (Hyper MCP). It adheres to safety best practices by ensuring that all campaigns, ad sets, and ads are created with a 'PAUSED' status by default, preventing unauthorized live deployments.
  • [EXTERNAL_DOWNLOADS]: The skill uses tools like meta_business_upload_ad_image which can ingest image assets from external URLs, and firecrawl tools to retrieve branding and screenshots from target websites. These operations are essential for the skill's primary purpose of ad creation and research.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites during the research phase, which represents a potential attack surface.
  • Ingestion points: Website content and screenshots retrieved via firecrawl_extract_branding and firecrawl_screenshot (Phase 1 in SKILL.md).
  • Boundary markers: No specific delimiters are used to wrap external content.
  • Capability inventory: The skill possesses the ability to create and modify advertising campaigns and assets through the meta_business_* toolset.
  • Sanitization: The skill employs a strong human-in-the-loop mitigation by requiring explicit user review of ad previews and a final manual activation step (meta_business_update_campaign) before campaigns go live.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 04:20 AM