Meta Ad Creatives

Track Meta (Facebook/Instagram) ad creative performance and hit rates across multiple accounts. Use when asked about creative win rates, which ads are hitting benchmarks, CPT/CPI/ROAS analysis, or comparing creative performance across accounts and time periods. Supports multiple benchmark metrics (CPT, CPI, IPM, ROAS) and currency conversion.

This skill appears to do what it says (query Meta Graph API, compute hit rates, store history), but there are several mismatches you should check before installing or running it: - The SKILL.md and the Python code expect FACEBOOK_ACCESS_TOKEN, FACEBOOK_APP_ID, and FACEBOOK_APP_SECRET (and will load a .env if present), but the registry metadata does not list any required environment variables. Treat this as a warning: the skill needs sensitive API credentials to operate. - The skill defaults to Firestore for storage unless you set USE_FIRESTORE=false. If left as default, it may attempt to use Google application-default credentials or other GCP service account keys — ensure you understand and control which cloud credentials will be available to the process. - There is no install/dependency specification. The script imports requests and python-dotenv; make sure you run it in a controlled environment with explicit dependency management (virtualenv, pinned requirements) to avoid supply-chain surprises. - The code will make network calls to graph.facebook.com using whatever access token you provide. Only supply tokens that are scoped appropriately and belong to accounts you expect the skill to read. Review the accounts_config.json to ensure it only lists accounts you want queried. - If you are concerned about cloud access, set USE_FIRESTORE=false to force local SQLite storage and run the tool in an isolated environment. Given these inconsistencies, do not provide production credentials or open cloud credentials to this skill until you (or a trusted reviewer) confirm the Firestore usage and add explicit install and credential declarations. If you want, provide the rest of the Python file (it was truncated in the review) and I can re-check for any additional network endpoints or unexpected behavior.

Type: OpenClaw Skill Name: meta-ad-creatives Version: 1.0.0 The OpenClaw AgentSkills skill bundle for 'meta-ad-creatives' is classified as benign. The Python script (`scripts/meta_ad_creatives.py`) correctly interacts with the Meta Graph API (`https://graph.facebook.com`) to fetch ad performance data, using environment variables for authentication (`FACEBOOK_ACCESS_TOKEN`, `FACEBOOK_APP_ID`, `FACEBOOK_APP_SECRET`). It stores processed data in a local SQLite database (`data/hit_rates.db`) and reads configuration from `accounts_config.json`, all within expected file paths. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution (e.g., `eval`/`exec` of untrusted input, downloading remote payloads), persistence mechanisms, or prompt injection attempts against the AI agent in `SKILL.md`. All operations are aligned with the stated purpose of tracking Meta ad creative performance.