metacli

This skill appears to be the Meta Marketing CLI it claims to be, but pay attention to a few risks before installing or using it: (1) The runtime instructions require APP_ID and APP_SECRET even though the metadata declares no required env vars — do not pass your App Secret or long-lived tokens without understanding where they will be stored and who/what can read them. Prefer short-lived tokens or manual exchange if possible. (2) The doc recommends exposing the AI host to receive OAuth callbacks (cloudflared) and binding a listener — verify you're comfortable running an endpoint that accepts web redirects. (3) The install builds a binary from github.com/bilalbayram/metacli; review the repo and lock to a specific commit or release rather than @latest. (4) Consider running the CLI in a sandboxed environment or ephemeral container, and confirm where tokens and schema files (e.g., ~/.meta/) are written. (5) Ask the skill author or maintainer to: declare APP_ID/APP_SECRET/REDIRECT_URI in requires.env or explicitly state how secrets are provided and stored, and list cloudflared (or alternate tunneling tools) in required binaries. If you cannot verify these details, treat the skill with caution and avoid supplying high-privilege app secrets.