ad-preflight
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches live policy text from Meta's Transparency Center (transparency.meta.com). This is a well-known service domain used to retrieve the ground truth for ad policy checks.
- [COMMAND_EXECUTION]: The skill executes a local Python script (render_report.py) to generate a visualization of findings. The script is bundled with the skill, uses only standard library modules, and implements HTML escaping for output.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests ad copy which is an external data surface. * Ingestion points: Ad content from user input or local files (SKILL.md Step 0). * Boundary markers: Not explicitly specified in the prompts. * Capability inventory: File operations, network fetching, and local script execution. * Sanitization: HTML escaping is performed during report rendering. The risk is mitigated by the requirement for the agent to provide verbatim citations from Meta's live policy pages for every finding.
Audit Metadata