analyzing-own-ads
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of advertisement copy, headlines, and media transcripts fetched from the Meta Ad Library using the
social_researchtool. This creates a surface for indirect prompt injection where adversarial text within an ad could attempt to influence the AI's analysis or audit conclusions. - Ingestion points: External ad metadata, copy (body text, titles, descriptions), and creative content are ingested into the agent context, as described in
SKILL.mdandreferences/pulling-own-ads.md. - Boundary markers: The analysis prompts defined in
references/reading-one-ad.mdprovide a narrative framework for the vision model but lack specific delimiters or negative constraints to ignore potentially malicious instructions embedded in the transcripts or text. - Capability inventory: The skill uses vision and language models for analysis, executes a local Python script (
build_ledger.py) for data processing, and writes multiple markdown files to the local file system. - Sanitization: While the
build_ledger.pyscript performs basic string normalization (e.g., whitespace trimming), there is no semantic filtering or sanitization of the ad copy to detect or neutralize prompt injection attempts before the content is analyzed by the LLM.
Audit Metadata