meta-ads-audit
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external sources, including Meta ad creative content and website text.
- Ingestion points: Ad names, primary text, and headlines from the Meta Ads API (/{accountId}/ads), as well as website content fetched via WebFetch (homepage, about page, and landing pages).
- Boundary markers: The instructions do not specify the use of delimiters or clear separation between system instructions and external data in the final report or during internal processing.
- Capability inventory: The skill possesses filesystem write capabilities to {data_dir}, as well as WebSearch and WebFetch tools.
- Sanitization: There is no evidence of content sanitization or filtering to prevent embedded instructions in the ad copy or website content from influencing the agent's behavior.
- [COMMAND_EXECUTION]: The skill uses the runScript tool to execute batch Meta Ads API queries through ads.graphParallel. This facilitates high-volume data retrieval for the audit process.
- [DATA_EXFILTRATION]: The skill gathers and stores sensitive business information, such as unit economics (AOV, profit margins) and customer personas, in the {data_dir}/meta/ directory. While this is intended for local persistence and context sharing, it centralizes sensitive business intelligence on the local filesystem.
Audit Metadata