Meta Ads Publisher

[Didoo AI] Executes Meta Ads campaign management tasks — creates new campaigns, makes changes, pauses/activates, changes budgets, duplicates campaigns. Use w...

Security Scan

The skill's instructions match its stated purpose (Meta Ads management) but the package metadata omits the sensitive credentials the SKILL.md says are required and the runtime guidance encourages use of raw access tokens in curl commands — an incoherence that increases risk and warrants caution.

Purpose & Capability

The SKILL.md describes exactly the Meta Marketing API calls and requires META_ACCESS_TOKEN and META_AD_ACCOUNT_ID which are appropriate for ad management. However, the registry metadata lists no required environment variables or primary credential — a clear mismatch between what the skill claims it needs and what the package declares.

Instruction Scope

Instructions stay within campaign-management scope (create/pause/clone campaigns) and provide concrete curl examples. They explicitly instruct using exec + curl with the access token embedded in requests, which is expected for API calls but increases the chance of token exposure (logs, chat history, command history). The guide warns not to paste tokens in conversation, but the examples demonstrate putting tokens directly into commands and suggest pulling tokens from the Graph API Explorer (a short-lived, user-level token), which may be incomplete or encourage unsafe handling.

Install Mechanism

No install spec or code files are present (instruction-only). This minimizes the risk of arbitrary code being downloaded or executed from external URLs.

Credentials

The SKILL.md requires two sensitive items (META_ACCESS_TOKEN and META_AD_ACCOUNT_ID). These are proportionate to the stated purpose, but the top-level skill manifest did not declare them as required env vars or a primary credential — an inconsistency that can hide credential requirements from users and automated permission reviewers.

Persistence & Privilege

The skill is not always-enabled and is user-invocable; it does not request persistent system-wide privileges or modify other skills' configs. Autonomous model invocation is allowed (default), which is normal for skills but increases blast radius if credentials are mishandled.

What to consider before installing

This skill appears to do what it says (manage Meta Ads) but has two red flags: the internal SKILL.md expects META_ACCESS_TOKEN and META_AD_ACCOUNT_ID yet the package metadata lists no required creds, and the examples show embedding tokens in curl commands (risking accidental exposure). Before installing: (1) verify the skill manifest is updated to declare required credentials so you can manage permissions; (2) only provide a least-privileged, short-lived token or a dedicated service token with minimal scopes; (3) avoid pasting tokens into chat or command history — use secure agent credential storage or environment variables; (4) confirm the agent will not log or transmit tokens to third parties; and (5) because the skill source is unknown, prefer manual verification (run commands yourself or review with a trusted admin) rather than granting the agent autonomous live access to your ad account.

Required Credentials

Credential	Where to Get	Used For
META_ACCESS_TOKEN	Meta Developer Console → Graph API Explorer → Generate Token	All Meta Marketing API calls
META_AD_ACCOUNT_ID	Ads Manager URL: adsmanager.facebook.com/act_XXXXXXXXX	All campaign operations

META_APP_ID and META_APP_SECRET are not needed — the access token alone is sufficient for all API operations.

How to Call the Meta API

Use exec + curl with your META_ACCESS_TOKEN. All requests go to https://graph.facebook.com/v21.0/.

Example structure:

curl -X POST "https://graph.facebook.com/v21.0/act_{AD_ACCOUNT_ID}/campaigns" \
  -d "access_token={META_ACCESS_TOKEN}" \
  -d "name=My Campaign" \
  -d "objective=LEADS" \
  -d "status=PAUSED"

---

When to Use

When user wants to launch a new campaign, make changes to an existing one, or do any campaign management task. Requires META_ACCESS_TOKEN and META_AD_ACCOUNT_ID.

---

Step 1: Authenticate

Required credentials:

• META_ACCESS_TOKEN — from Meta Developer Console (Graph API Explorer)
• META_AD_ACCOUNT_ID — format: act_XXXXXXXXX (from Ads Manager URL)

If credentials are not yet configured: Guide the user to get them:

1. Access Token: Go to developers.facebook.com/tools/explorer → select App → Generate Token → copy
2. Ad Account ID: adsmanager.facebook.com → Account Settings → find act_XXXXXXXXX

Store credentials securely. Never paste tokens into open conversation unless absolutely necessary.

---

Step 2: Create New Campaign

Campaign Level

POST to /act_{AD_ACCOUNT_ID}/campaigns

• objective: LEADS / PURCHASE / LINK_CLICK / AWARENESS
• status: PAUSED (create paused, activate after review)
• name: [Descriptive name: Product + Audience + Date]
• budget_type: DAILY or LIFETIME

Adset Level

POST to /act_{AD_ACCOUNT_ID}/adsets

• campaign_id: [From step above]
• status: PAUSED
• optimization_goal: corresponds to campaign objective
• billing_event: IMPRESSIONS / LINK_CLICK / etc.
• bid_amount: [If using manual bid]
• targeting: age, gender, geo, interests, behaviors
• daily_budget or lifetime_budget

Creative / Ad Level

Upload image first: POST /act_{AD_ACCOUNT_ID}/adimages Then reference image_hash in creative.

POST to /act_{AD_ACCOUNT_ID}/ads

• adset_id: [From adset step]
• creative: reference to adcreative
• status: PAUSED

---

Step 3: Pre-flight Checklist — Before Activating

Before setting status to ACTIVE, verify all of the following:

1. Campaign status is PAUSED — never launch in ACTIVE status; always review first
2. Budget confirmed with user — confirm the daily budget amount before going live
3. Targeting is appropriate — not too broad (> 1M people is too broad for interest-based) or too narrow (< 100K people may not have enough volume)
4. Creative passed Quality Check — confirm the ad creative has been reviewed
5. Pixel and CAPI installed — verify Meta pixel is firing and CAPI is connected
6. Bid strategy matches the objective — lowest cost for testing, cost cap for CPL control, target cost for scaling

---

Step 4: Campaign Management Tasks

Pause / Activate

PATCH /act_{AD_ACCOUNT_ID}/adsets?ids=[ADSET_ID] Set status to PAUSED or ACTIVE.

Change Budget

PATCH /act_{AD_ACCOUNT_ID}/adsets?ids=[ADSET_ID] Set new daily_budget or lifetime_budget. Rule: Change by max 20% per adjustment to avoid disrupting learning.

Check Campaign List

GET /act_{AD_ACCOUNT_ID}/campaigns?fields=id,name,status,objective,daily_budget

Get Performance

GET /act_{AD_ACCOUNT_ID}/insights?fields=spend,impressions,clicks,results,cpc,cpm,ctr&level=[campaign|adset|ad]&time_range={'since':'YYYY-MM-DD','until':'YYYY-MM-DD'}

Duplicate / Clone Campaign

When you have a winner campaign and want to replicate it to a new audience, geo, or offer, follow these 6 steps:

Step 1: Get source campaign structure

GET https://graph.facebook.com/v21.0/[CAMPAIGN_ID]?fields=id,name,status,objective,daily_budget&access_token=[TOKEN]

Step 2: Get source adsets

GET https://graph.facebook.com/v21.0/[ADSET_ID]?fields=id,name,status,optimization_goal,targeting,daily_budget,bid_amount&access_token=[TOKEN]

Step 3: Get source ads

GET https://graph.facebook.com/v21.0/[AD_ID]?fields=id,name,status,creative&access_token=[TOKEN]

Step 4: Create new campaign (PAUSED)

POST https://graph.facebook.com/v21.0/act_[AD_ACCOUNT_ID]/campaigns
  access_token=[TOKEN]
  name=[NEW_NAME — e.g. "Didoo AI — US — Interest — 2026-04-14"]
  objective=[SAME AS SOURCE]
  status=PAUSED
  budget_type=DAILY

Step 5: Create new adset(s) with modified targeting/budget

POST https://graph.facebook.com/v21.0/act_[AD_ACCOUNT_ID]/adsets
  access_token=[TOKEN]
  campaign_id=[NEW CAMPAIGN ID]
  name=[NEW ADSET NAME]
  optimization_goal=[SAME AS SOURCE — e.g. LEAD_GENERATION]
  targeting=[MODIFIED — change geo, age, interests, etc.]
  daily_budget=[NEW BUDGET — integer in cents, e.g. 5000 = $50/day]
  status=PAUSED

Step 6: Create new ad(s)

POST https://graph.facebook.com/v21.0/act_[AD_ACCOUNT_ID]/ads
  access_token=[TOKEN]
  adset_id=[NEW ADSET ID]
  name=[NEW AD NAME]
  creative={'creative_id': '[NEW_CREATIVE_ID]'}
  status=PAUSED

Review BEFORE activating:

1. Verify targeting is correct for the new audience
2. Confirm budget is realistic
3. Review creative and copy
4. Set status to ACTIVE only after review

---

Step 5: Common Issues

Issue	Check
Campaign not delivering	Is status ACTIVE? Is budget more than $5/day? Is targeting too narrow?
Ads in Learning Limited	Need ~50 results/week to exit; increase budget or consolidate adsets
High frequency	Expand audience or rotate new creative
Low CTR	Test new creative; check if audience matches the hook
Cost per result too high	Check if budget is realistic; test narrower targeting

---

Output Rules

• Always confirm what was done: "Campaign created in PAUSED status. Ready to review before I activate it."
• After any change, summarize what changed and what to expect
• If user asks for a campaign list, format as a readable table

---

Security Rules

• Never log or print access tokens in plain text
• Store credentials in platform's secret management only
• Only use credentials for Meta Marketing API — never for other purposes

---

Key Numbers to Know

• Budgets in cents (5000 = $50.00) in API calls
• Ad Account ID format: act_XXXXXXXXX
• Minimum viable daily budget for learning: ~$10–15/day per adset
• Need ~50 results per week per adset to exit learning phase