metaads
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the
uvtool fromastral.sh, which is the official distribution domain for this widely-used developer utility. - [REMOTE_CODE_EXECUTION]: The documentation includes a command pattern for downloading and executing a setup script via
curl | shto install theuvpackage manager. This source is recognized as the official provider for the tool. - [COMMAND_EXECUTION]: The skill requires the execution of Python scripts (
Publish.pyandAnalytics.py) via theuv runcommand to perform its primary marketing tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON campaign configurations and local image assets.
- Ingestion points: Campaign parameters defined in JSON files and ad images located in user-specified directories.
- Boundary markers: The workflow utilizes structured JSON templates to separate user data from instructions.
- Capability inventory: The skill performs network requests to
graph.facebook.comand manages local files for analytics exports. - Sanitization: Employs standard JSON parsing and relies on the Meta Marketing API for input validation.
Audit Metadata