Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed baiz.ai/Facebook ads control reference that can spend or change ad campaigns, but its network use and credential handling match its stated purpose.
Install only if you trust baiz.ai with the connected ad accounts and billing impact. Start with a revocable minimal-permission or read-only test token, avoid autonomous use, verify each campaign or budget-changing action before sending it, and revoke the token if metadata or endpoint behavior does not match the artifact.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://baiz.ai/mcp" \
-H "Authorization: Bearer {TOKEN}" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
The manifest description is written as a fixed bilingual Chinese/English string rather than offering a user language choice. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy concern when no explicit language preference mechanism is documented.
No suspicious patterns detected.