Back to skill
Skillv1.0.0
ClawScan security
Meta Ads Builder · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 14, 2026, 5:31 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- An instruction-only skill that cleanly matches its stated purpose (generating Meta ad creative); it requires no installs or mandatory credentials and only offers optional tokens for enhanced features.
- Guidance
- This skill is internally consistent and low-risk as an instruction-only generator, but consider these practical precautions before enabling it: only provide META_ACCESS_TOKEN or GEMINI_API_KEY if you need the optional features, and use keys with minimum scopes; avoid giving the skill sensitive PII or proprietary creative assets if you don't want them sent to external image/A.I. services; verify that any generated claims, testimonials, or imagery comply with Meta advertising policies and copyright rules; revoke or rotate tokens after use if you provided them; and be aware that web_fetch/image-tools may send prompts or fetched data to external endpoints — only proceed if you trust those services or the environment in which the agent runs.
Review Dimensions
- Purpose & Capability
- okName/description (Meta Ads creative) align with the instructions. No unexpected binaries, config paths, or unrelated credentials are required. The optional META_ACCESS_TOKEN and GEMINI_API_KEY are plausibly related to the advertised enhancements (performance data and AI image generation).
- Instruction Scope
- noteSKILL.md stays within ad-creation scope (campaign context, hooks, copy rules, visual directions). It allows use of web_search, web_fetch, and image-tools which can contact external services — appropriate for fetching performance data or generating images, but note these tools can transmit prompts or campaign content externally if used.
- Install Mechanism
- okNo install spec and no code files — instruction-only skills have minimal on-disk risk. Nothing is downloaded or installed by the skill itself.
- Credentials
- okNo required environment variables or primary credential. The two credentials listed in SKILL.md are explicitly optional and justified by the described optional features (pulling Meta creative metrics and using Gemini for image generation).
- Persistence & Privilege
- okalways is false, autonomous invocation is allowed (platform default). The skill does not request persistent installation, nor does it modify other skills or system-wide settings.