website to ads

Scrape any business website and generate 5 Meta-ready ad variants matching the brand's voice. Use when the user wants to create ads, generate ad copy, or tur...

Security Scan

The skill's functionality (scrape a website and generate ad copy) is coherent, but the package includes install/build steps and writes cached files despite metadata claiming instruction-only — and it asks for optional Civic tokens and will persist/cache data, so review before installing or supplying real keys.

Purpose & Capability

Name/description match the code and declared dependencies: it scrapes websites (Apify), analyzes/generates copy (OpenAI), and optionally verifies identity (Civic) before export. Required env vars (APIFY_TOKEN, OPENAI_API_KEY) and npm deps are consistent with the stated purpose.

Instruction Scope

Runtime instructions and code stick to the advertised flow (scrape → analyze → generate → optional Civic-gated export). The skill loads environment variables, uses Apify and OpenAI, prompts for Civic tokens if needed, and writes cache files under a .cache directory. It also exposes an aggressive 'offensive' ad tone that can produce abusive or defamatory content (business/legal/reputational risk) — not a code-level incoherence, but a behavioral risk to be aware of.

Install Mechanism

Registry metadata at the top claimed 'No install spec — instruction-only', but the bundle contains code, package.json, package-lock.json and skill.json with install.commands (npm install, npm run build). Installing will pull npm packages from public registries (apify-client, openai, @civic/auth-verify, etc.). Those packages are expected for the functionality, but the metadata mismatch (instruction-only vs code + install steps) is an incoherence and increases risk because code will be written to disk and dependencies installed.

Credentials

Requested secrets are proportional: APIFY_TOKEN and OPENAI_API_KEY are required and needed for scraping and LLM calls. Civic tokens/IDs/flags are optional and only used for gated export. The skill uses typical optional env vars (OPENAI_MODEL, CIVIC_ACCESS_TOKEN) and does not request unrelated credentials.

Persistence & Privilege

The skill writes a local cache (.cache/<md5>.json) and reads/writes files in the current working directory. It does not request always:true privilege and does not appear to modify other skills. If installed, expect persistent cached brand data on disk until removed.

What to consider before installing

Things to consider before installing or running this skill: - Metadata mismatch: the registry description said 'instruction-only' but the package includes TypeScript source, package.json, and install commands (npm install / npm run build). Installing will download and run npm packages and build code on your machine. - Required credentials: you must supply APIFY_TOKEN and OPENAI_API_KEY for full functionality. Civic tokens are optional and only used for gated export. Do NOT paste high-privilege or production keys into unfamiliar code — prefer scoped/test keys. - Persistence: the skill creates a .cache folder in the working directory and stores scraped content + analyzed brand data for 24 hours. If this data is sensitive, run in an isolated environment or remove cache files after use. - Reputation/legal risk: the skill includes an 'offensive' ad tone that explicitly instructs the model to produce abusive/attack-style copy and competitor naming. That may produce defamatory or policy-violating output; avoid that tone for real campaigns. - Install in a sandbox: because the package installs npm dependencies and builds code, review the source (especially src/auth.ts and any network calls) and install/run in a container or isolated CI runner if you don't fully trust the author. - Operational checks: confirm the Node runtime requirement (skill.json specifies node ">=22.12.0") matches your environment, and rotate any keys you use for testing. If you plan to export campaigns to Meta, verify that the skill does not directly push without explicit confirmation and inspect the payload it would send. If you want, I can: list the specific files that perform network calls, summarize src/auth.ts contents, or highlight any lines that read environment variables or write files.

Quick Start

Ask the agent:

"Generate ads for https://example.com"

Tools

• scrape_website — Scrape a URL into cleaned text
• generate_ads — Analyze brand + generate ad variants from text
• website_to_ads — End-to-end: URL → brand profile → numbered ads

Requirements

Set these environment variables before use:

export APIFY_TOKEN=your_apify_token
export OPENAI_API_KEY=your_openai_key
export CIVIC_AUTH_ENABLED=false
export CIVIC_CLIENT_ID=your_civic_client_id
export CIVIC_ACCESS_TOKEN=your_civic_access_token

Output

Each ad includes: hook, body, CTA, visual direction, Meta-compatible targeting, and daypart scheduling.

Meta export behavior:

• Anyone can generate and review ads.
• If CIVIC_AUTH_ENABLED=true, exporting selected ads to Meta requires a valid Civic token.
• For CLI demos, set CIVIC_ACCESS_TOKEN to skip token prompts.
• Never commit real API keys or Civic access tokens to the repository.