Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Meta Ads Daily Pulse

v1.1.0

[Didoo AI] Rapid daily health scan for Meta Ads — detects week-over-week performance changes and flags urgent issues before meetings. Use every morning or be...

0· 95·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for elias-didoo/meta-ads-daily-pulse.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Meta Ads Daily Pulse" (elias-didoo/meta-ads-daily-pulse) from ClawHub.
Skill page: https://clawhub.ai/elias-didoo/meta-ads-daily-pulse
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: META_ACCESS_TOKEN, META_AD_ACCOUNT_ID
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install meta-ads-daily-pulse

ClawHub CLI

Package manager switcher

npx clawhub@latest install meta-ads-daily-pulse
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description ask for Meta Ads insights and the skill only requires META_ACCESS_TOKEN and META_AD_ACCOUNT_ID — which is proportionate. However, the runtime instructions call python3 for dates even though the registry lists no required binaries; that mismatch is an omission the author should fix (declare python3 or provide a pure-shell alternative).
!
Instruction Scope
SKILL.md instructs the agent to run curl via shell and to pass the access token on the command line (-d access_token=...), which can expose tokens in process listings and shell history. It also contains an internal contradiction: the 'Skill Boundary' says 'do not output recommendations' yet the 'Rules' require 'One immediate action per issue' (an action is effectively a recommendation). The skill also tells the agent not to re-fetch data in the same session — that is fine but relies on session state management that may not be enforced.
Install Mechanism
Instruction-only skill with no install spec or code files — low disk/write risk. There is no external download or package installation declared.
Credentials
Only META_ACCESS_TOKEN and META_AD_ACCOUNT_ID are required, which aligns with the Meta Graph API use. However, the way the token is used (exposed on the command line) is a risk to credential confidentiality. Also the skill does not declare a 'primary credential' even though one env var is the main secret; that's a minor metadata omission.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system privileges. Autonomous model invocation is allowed (platform default), but there is no additional privileged presence requested.
What to consider before installing
This skill looks like what it says (a Meta Ads daily change detector) but has some issues you should address before using it with real credentials: 1) The SKILL.md runs python3 for date math but the skill metadata doesn't declare python3 as a required binary — confirm the runtime will have Python or change the instructions to a shell-only method. 2) The curl examples embed the access token on the command line; that can leak via process listings and shell history. Prefer sending the token in an Authorization header (e.g., -H "Authorization: Bearer $META_ACCESS_TOKEN") or otherwise avoid putting secrets in argv. 3) The doc contradicts itself about recommendations: it says 'do not output recommendations' but also asks for 'one immediate action per issue' — clarify whether the skill should propose actions or not. 4) Confirm the referenced companion skill (meta-ads-recommendation) exists if the intent is to offload remediation. If you proceed, only provide a token with read-only ads_read scope and consider rotating the token after testing. If you want, ask the skill author to (a) declare python3 in required binaries, (b) update curl examples to use an Authorization header, and (c) fix the recommendation vs detection contradiction.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvMETA_ACCESS_TOKEN, META_AD_ACCOUNT_ID
latestvk970mndxtgzxp4hjgeyys53tk184z9yr
95downloads
0stars
2versions
Updated 1w ago
v1.1.0
MIT-0

Meta Ads Daily Pulse

Required Credentials

CredentialWhere to GetUsed ForOAuth Scope
META_ACCESS_TOKENMeta Developer Console → Graph API Explorer → Generate TokenFetching account and campaign insightsads_read (read-only)
META_AD_ACCOUNT_IDAds Manager URL: adsmanager.facebook.com/act_XXXXXXXXXIdentifying which account to query

When to Use

Use every morning or before any daily review meeting. This skill is a change detector — it answers: "Did anything important change overnight compared to the same day last week?"

Not sure which monitoring skill to use?

meta-ads-daily-pulsemeta-ads-healthcheck
Primary question"Did anything change vs. last week?""Is this campaign healthy or not?"
Comparison basisSame day of prior week (WoW)Fixed Green/Yellow/Red thresholds
Best forDaily routine, morning check, meeting prepSomething feels off — quick on-demand check
Output styleChange alerts ranked by revenue impactCampaign-by-campaign status report

Requirements

  • account_id (required)
  • date_range: yesterday (default) — fetches yesterday's data; compare to same day of prior week (WoW)
  • campaign_ids (optional) — defaults to all active campaigns

Step 1: Pull Account Baseline

Fetch account-level metrics for yesterday and the same day of the prior week:

  • Spend, impressions, results, ROAS
  • CTR, CPC, CPM, frequency
  • Conversions, cost per conversion

Use exec + curl to call the Meta Graph API:

Account-level (yesterday):

# Cross-platform date helper (Python, works on macOS and Linux):
YESTERDAY=$(python3 -c "from datetime import date, timedelta; print((date.today() - timedelta(days=1)).isoformat())")
SAME_DAY_LAST_WEEK=$(python3 -c "from datetime import date, timedelta; print((date.today() - timedelta(days=8)).isoformat())")

curl -G "https://graph.facebook.com/v21.0/act_${META_AD_ACCOUNT_ID}/insights" \
  -d "fields=spend,impressions,results,roas,ctr,cpc,cpm,frequency,conversion_rate" \
  -d "time_range={'since':'${YESTERDAY}','until':'${YESTERDAY}'}" \
  -d "access_token=${META_ACCESS_TOKEN}"

Same day of prior week (7 days back):

# Same YESTERDAY and SAME_DAY_LAST_WEEK variables as above

curl -G "https://graph.facebook.com/v21.0/act_${META_AD_ACCOUNT_ID}/insights" \
  -d "fields=spend,impressions,results,roas,ctr,cpc,cpm,frequency,conversion_rate" \
  -d "time_range={'since':'${SAME_DAY_LAST_WEEK}','until':'${SAME_DAY_LAST_WEEK}'}" \
  -d "access_token=${META_ACCESS_TOKEN}"

Campaign-level (yesterday, if you need per-campaign breakdown):

# Same YESTERDAY variable as above

curl -G "https://graph.facebook.com/v21.0/act_${META_AD_ACCOUNT_ID}/insights" \
  -d "fields=campaign_name,spend,impressions,results,roas,ctr,cpc,cpm,frequency" \
  -d "level=campaign" \
  -d "time_range={'since':'${YESTERDAY}','until':'${YESTERDAY}'}" \
  -d "access_token=${META_ACCESS_TOKEN}"

Important — Same Day of Prior Week comparison: Meta Ads performance follows day-of-week patterns (e.g., Tuesdays often differ from Saturdays). Always compare each day to its same day of prior week — not the prior day. Comparing to the prior day creates false alarms.

For each day in the date range, pull the equivalent day from 7 days prior:

  • Monday this week → Monday last week
  • Tuesday this week → Tuesday last week
  • etc.

Step 2: Run Detection Checks

Run all four detection checks:

#IssueDetection Logic
1Spend without conversionsspend > 0 AND conversions = 0
2Week-over-week dropCTR, ROAS, or CVR down > 20% vs same day of prior week
3Budget cap + strong ROASspend > 80% daily budget AND ROAS > 2x account average
4Creative fatiguefrequency > 3 AND CTR declining vs same day of prior week

For each flag, calculate estimated revenue impact:

  • Lost conversions = (prior period CVR − current CVR) × current impressions
  • Revenue impact = lost conversions × average order value

Step 3: Prioritize by Revenue Impact

Sort alerts by estimated revenue impact. Do not exceed 3 items per section.


Step 4: Format Output

🚨 Critical
- [Campaign/Ad ID]: [Issue] | [Metric] | [Immediate action]

⚠️ Watch
- [Trending decline not yet critical]

✅ Healthy
- [Brief confirmation]

💡 Opportunity
- [Quick win if found]

Skill Boundary

  • This is a detection tool only — do not output recommendations
  • After flagging issues, route to meta-ads-recommendation for action plans
  • If you need a full campaign-by-campaign status check (not change-focused), use meta-ads-healthcheck instead

Rules

  • Always compare to the same day of prior week (not prior day — day-of-week patterns matter in Meta Ads)
  • Include specific campaign/ad IDs and numbers in every line
  • One immediate action per issue
  • Do not re-fetch data if it was recently pulled in the same session

Comments

Loading comments...