Facebook Ad Library & Meta Ad Library
v1.0.1Search Facebook Ad Library and Meta Ad Library data with PPSPY. Analyze ads, advertiser stores, landing pages, and ad products from one focused skill.
⭐ 0· 52·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the declared requirement (PPSPY API). The SKILL.md asks for PPSPY_API_KEY and to install/run a ppspy MCP server binary (ppspy-mcp-server) via npm, which is coherent with a PPSPY-backed ad-library skill.
Instruction Scope
Runtime instructions are limited to obtaining a PPSPY API key, installing/using the ppspy-mcp-server, and calling PPSPY APIs. There are no instructions to read unrelated files, access other credentials, or exfiltrate data beyond the PPSPY service.
Install Mechanism
The SKILL.md includes an npm global install: npm install -g ppspy-mcp-server@1.0.1. Installing an npm package globally is a standard mechanism but runs package install scripts and writes to disk (moderate risk). Also note a minor inconsistency: registry metadata said 'No install spec' while SKILL.md contains an install command.
Credentials
Only PPSPY_API_KEY is required and marked as primaryEnv; this matches the service being accessed. No unrelated environment variables or config paths are requested.
Persistence & Privilege
Skill is not always-enabled and does not request elevated platform privileges. It will install and run a local MCP server process (its own binary) but does not attempt to modify other skills or system-wide agent settings.
Scan Findings in Context
[no-findings-detected] expected: The regex scanner found no code files to analyze. This is expected for an instruction-first skill, but SKILL.md does include an npm install step which the scanner could not evaluate.
Assessment
This skill appears to do what it claims: it calls PPSPY to search Meta/Facebook ad data and asks only for a PPSPY API key. Before installing: (1) verify you trust the ppspy NPM package and the publisher (check the package page, maintainers, and recent versions on the npm registry and ppspy.com), because global npm installs run code during install; (2) prefer installing in an isolated environment (container or VM) if you want to limit risk; (3) ensure the PPSPY_API_KEY has minimal privileges and monitor its usage/credits; (4) note the registry metadata omitted an install spec even though SKILL.md includes one—confirm the intended install step with the skill author or publisher if you need higher assurance.Like a lobster shell, security has layers — review code before you run it.
latestvk97eyt5b5c62qy0awfgzpsqvgx8431m7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis
Binsnpm
EnvPPSPY_API_KEY
Primary envPPSPY_API_KEY