Meta Ads Report Skill

PendingStatic analysis audit pending.

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

When configured, the agent can retrieve spend, conversion, CAC, and event data for the specified Meta ad account.

Why it was flagged

The skill requires a Meta access token and ad account ID. This is expected for Meta Ads reporting and uses read-oriented permissions, but it gives the agent access to the configured ad account’s reporting data.

Skill content

`META_ACCESS_TOKEN` | User Access Token from Meta Developers | **Yes** ... Add Permissions: `ads_read`, `read_insights`.

Recommendation

Use the least-privilege Meta token needed for ads reporting, limit it to the intended account where possible, store it securely, and revoke or rotate it when no longer needed.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Dependency changes could affect behavior or introduce vulnerabilities if installed without review.

Why it was flagged

The skill lists third-party Python packages without exact version pins. With no install spec, users or environments may resolve different dependency versions.

Skill content

facebook_business
python-dotenv
urllib3<2

Recommendation

Install dependencies in an isolated environment and consider pinning or verifying package versions before use.