Meta Ads Report Skill
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: meta-ads-report Version: 1.0.0 The OpenClaw AgentSkills bundle for Meta Ads Analytics and Event Finder is benign. It uses the official `facebook_business` SDK to interact with the Meta Graph API for its stated purpose of fetching ad performance data and event lists. Credentials (`META_ACCESS_TOKEN`, `META_AD_ACCOUNT_ID`) are securely loaded from environment variables via `python-dotenv`. The `SKILL.md` and `README.md` files provide clear, non-malicious instructions for setup and usage, without any prompt injection attempts to subvert the agent. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation in any of the provided files (e.g., `main.py`, `meta_event_list.py`).
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
When configured, the agent can retrieve spend, conversion, CAC, and event data for the specified Meta ad account.
The skill requires a Meta access token and ad account ID. This is expected for Meta Ads reporting and uses read-oriented permissions, but it gives the agent access to the configured ad account’s reporting data.
`META_ACCESS_TOKEN` | User Access Token from Meta Developers | **Yes** ... Add Permissions: `ads_read`, `read_insights`.
Use the least-privilege Meta token needed for ads reporting, limit it to the intended account where possible, store it securely, and revoke or rotate it when no longer needed.
Dependency changes could affect behavior or introduce vulnerabilities if installed without review.
The skill lists third-party Python packages without exact version pins. With no install spec, users or environments may resolve different dependency versions.
facebook_business python-dotenv urllib3<2
Install dependencies in an isolated environment and consider pinning or verifying package versions before use.