meta-api-reference
Fail
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Automated security scanners flagged the domain landing.com, which appears in several creative examples (e.g., https://landing.com), as malicious. While used as a placeholder in documentation, developers should avoid this domain in production code.
- [DATA_EXFILTRATION]: The skill includes code snippets for network operations targeting non-whitelisted domains used as placeholders, such as landing.com and product1.com. This practice deviates from using standard domains like example.com.
- [PROMPT_INJECTION]: The skill enables an indirect prompt injection surface by instructing the agent on how to ingest data from external Meta API responses, where malicious content could influence the agent's logic.
- Ingestion points: Campaign content, ad names, and insight data fetched from graph.facebook.com.
- Boundary markers: None identified in the provided instructions to isolate untrusted data.
- Capability inventory: Network operations using the requests library.
- Sanitization: No input validation or sanitization is prescribed for the data retrieved from the API.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata