meta-ad-library-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the 'scavio' package (Python and Node.js) and the 'requests' library. These are standard dependencies hosted on official public registries (PyPI and NPM) and are owned by the skill vendor.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage authentication via an environment variable (SCAVIO_API_KEY) and provides clear setup instructions. Examples use descriptive placeholders rather than hardcoded credentials.
- [COMMAND_EXECUTION]: Python and JavaScript snippets are provided as implementation examples for interacting with the API. They do not contain any arbitrary command execution or suspicious subprocess calls.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of ad copy and creative content from Meta's platforms. This represents an indirect injection surface. However, the skill includes explicit guardrails for the agent to treat this content as third-party data and to avoid fabricating or misrepresenting the results.
- [DATA_EXFILTRATION]: Network activity is restricted to the vendor's official API domain (api.scavio.dev) for the purpose of fulfilling the skill's search functions. No unauthorized data transmission was detected.
Audit Metadata