facebook-ads

SUSPICIOUS. The skill's capabilities broadly match its stated purpose, and the CLI install appears to use an official npm package rather than a covert payload. The main concern is data-flow and trust expansion: Meta Ads access is mediated through Membrane's third-party CLI/service and proxy, which can read or act on account data, plus the install uses an unpinned `@latest` version. This is not confirmed malware, but it carries medium risk due to credential delegation, intermediary routing, and real-world write actions.