metaads

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the uv tool from astral.sh, which is the official distribution domain for this widely-used developer utility.
  • [REMOTE_CODE_EXECUTION]: The documentation includes a command pattern for downloading and executing a setup script via curl | sh to install the uv package manager. This source is recognized as the official provider for the tool.
  • [COMMAND_EXECUTION]: The skill requires the execution of Python scripts (Publish.py and Analytics.py) via the uv run command to perform its primary marketing tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON campaign configurations and local image assets.
  • Ingestion points: Campaign parameters defined in JSON files and ad images located in user-specified directories.
  • Boundary markers: The workflow utilizes structured JSON templates to separate user data from instructions.
  • Capability inventory: The skill performs network requests to graph.facebook.com and manages local files for analytics exports.
  • Sanitization: Employs standard JSON parsing and relies on the Meta Marketing API for input validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:07 AM