v1.5.1 - Security Hardening

Security hardening release. Full 8-agent cybersecurity audit, 10 fixes applied, score improved from 62/100 to 90/100.

SSRF Protection

• New shared validation module (scripts/url_utils.py) blocks requests to private/internal IPs
• All 3 URL-handling scripts (fetch_page, analyze_landing, capture_screenshot) now use it
• IPv4 and IPv6 private ranges blocked, including cloud metadata (169.254.x.x) and CGNAT (100.64.x.x)
• DNS resolution failures now reject the URL instead of passing through silently

Error Sanitization

• API keys, tokens, and passwords are stripped from error messages before output
• Stability API error responses truncated to 200 characters
• Reference image paths validated against an extension allowlist
• Batch mode capped at 50 jobs with 8192px dimension limit

CI/CD Hardening

• GitHub Actions pinned to immutable SHA hashes (not mutable tags)
• Dependabot auto-merge restricted to patch updates only
• pip-audit runs on every PR to catch vulnerable dependencies
• CI scoped to read-only permissions

Installer Fixes

• Standard pip tried first, --break-system-packages is now the fallback (not the default)
• Trap cleanup variable properly quoted
• .gitignore updated to exclude certificate and credential files

v1.5.0: 250+ Audit Checks, PDF Reports, Security Hardening

What's New

22 New Audit Checks (190 to 212 in reference files, 250+ total)

Google Ads (74 to 80): AI Max for Search evaluation, Demand Gen image assets, VAC migration status, Demand Gen frequency cap loss, CTV Floodlight limitation, PMax negative keywords.

Meta Ads (46 to 50): Andromeda creative diversity (Similarity Score >60% = suppression), post-Jan 2026 attribution, Incremental Attribution, Threads placement.

LinkedIn Ads (25 to 27): CRM integration with Salesforce/HubSpot, EU Sponsored Messaging compliance.

TikTok Ads (25 to 28): Search Ads toggle, GMV Max mandatory for Shop, Events API Gateway.

Microsoft Ads (20 to 24): Scheduled import safety, Consent Mode May 5 2025, CTV campaigns, Video ads.

Cross-platform (new): Privacy infrastructure gate (X-PI1), creative diversity (X-CD1), refresh cadence (X-RF1).

3 New Skills

• /ads math: PPC financial calculator with 7 tools (CPA, ROAS, break-even, impression share, budget forecasting, LTV:CAC, MER). Works offline with pasted data.
• /ads test: A/B test design with IF/THEN/BECAUSE hypothesis framework, statistical significance calculator, sample size tables, and platform-specific guides.
• /ads report: Professional PDF audit reports with health score gauge chart, platform comparison bars, pass/fail distribution donut, formatted tables, and content quality guardrail.

PDF Report Generator

New scripts/generate_report.py with:

• State machine markdown parser converting bold and italic to rendered PDF text
• 3 matplotlib charts (health gauge, platform bars, result distribution donut)
• Word-wrapped table cells preventing horizontal overflow
• Section dividers and chart captions on every figure
• Content quality checker via --check flag (warns on missing charts, empty tables, overflow risk)
• CLI: --json, --check, --brand, --output, --verbose

Security Hardening

• SSRF protection in analyze_landing.py and capture_screenshot.py: blocks loopback, private, and link-local IPs via DNS resolution check before Playwright navigation
• Path traversal fix in generate_image.py batch mode: strips directory components from user-supplied output filenames
• Deprecated tempfile.mktemp() replaced with secure mkstemp() across all chart generators

Platform Updates (2025-2026 Research-Backed)

• Google: Consent Mode V2 enforcement July 21 2025, ECPC fully deprecated March 2025, Smart Bidding Exploration (+18% queries, +19% conversions), Demand Gen replaces VAC April 2026
• Meta: Andromeda engine (Oct 2025) makes creative diversity the #1 lever, EMQ tiers (Purchase 8.5+, AddToCart 6.5+), Offline Conv API permanently discontinued May 2025
• LinkedIn: renamed Campaign Groups to Campaigns (Oct 2025), Manual CPC recommended first (flipped from Maximum Delivery), TLA expanded to non-employees March 2025
• TikTok: Smart+ modular control (lock targeting/creative/budget independently), GMV Max mandatory July 2025, creative lifespan compressed to 7-10 days
• Microsoft: Copilot ads (+73% CTR), CTV campaigns, auto-generated RSA Jan 2026, CPCs 30-70% cheaper than Google
• Apple: rebranded to "Apple Ads" April 2025, CPP limit doubled to 70, Maximize Conversions GA Feb 26 2026, AdAttributionKit dual attribution
• YouTube: Demand Gen multi-format (+20% conversions), CTV 75% of ad spend, Floodlight does NOT work on CTV

Plugin Compliance

• plugin.json: author as object (not string), skills paths ["./ads/", "./skills/"], 13 keywords
• marketplace.json: proper Anthropic schema with owner + plugins array
• Ready for submission via /plugin marketplace add AgriciDaniel/claude-ads

17 SVG Diagrams

Brand-themed diagrams embedded throughout the README: architecture, parallel audit pipeline, platform grid, scoring algorithm, quality gates, creative pipeline, privacy flow, MCP integration, install methods, audit lifecycle, data flow, industry templates, PPC calculators, A/B testing, PDF pipeline, and platform checks.

Reference File Updates

• 25 reference files (was 23)
• New: mcp-integration.md (Google/Meta/LinkedIn MCP server pairing guide), additional-platforms.md (Reddit, CTV/OTT, Pinterest, Snapchat)
• Updated: benchmarks, bidding strategies, conversion tracking, compliance, platform specs, scoring system (all 7 audit checklists)

Other Changes

• All deprecated terms confined to historical context only (ECPC, VAC, Creative Sets, Apple Search Ads, FID)
• Replaced all em dashes and double hyphens with natural punctuation
• README: plugin install method, data handling section, MCP integration links
• requirements.txt: added reportlab and matplotlib
• 10 quality gates in orchestrator (added PDF report guardrail and privacy infrastructure gate)

Full Changelog: v1.4.0...v1.5.0

---

Blog post: claude-ads v1.5: 250+ Ad Audit Checks Across 7 Platforms

v1.4.0 - Banana Integration, Creative Pipeline Overhaul, E-commerce Templates

What's New

Banana-Claude Integration

Replaced generate_image.py with banana-claude (v1.4.1) as the default image generation provider. Uses MCP tools (gemini_generate_image, set_aspect_ratio), 5-component prompt formula, 9 domain modes, and brand presets.

Creative Pipeline Overhaul

• Visual consistency anchoring: visual-designer generates a "hero" image first and passes it as a style reference to all subsequent campaign assets
• 3-variant A/B strategy: visual-designer now generates 3 variants per brief (base, alternative angle, lighting/mood variation) instead of 2
• Copy zone validation: format-adapter uses Claude vision to check if generated images have clear space in platform-specific copy zones
• Quality gate: ads-generate scores each image 1-10 via Claude vision; auto-regenerates if score below 6
• Campaign cost tracking: reads banana's ~/.banana/costs.json and aggregates per-campaign creative spend

New Reference Files

• Voice-to-style mapping (voice-to-style.md): Maps 6 brand voice axes to visual attributes for banana's [STYLE] prompt component
• Ad copy frameworks (copy-frameworks.md): 6 proven frameworks (AIDA, PAS, BAB, 4P, FAB, Star-Story-Solution) with platform-specific templates
• E-commerce creative playbook (ecommerce-creative.md): 5 campaign types with banana domain modes, aspect ratios, copy frameworks, and budget allocation

Agent Updates

• creative-strategist: Reads voice-to-style.md, copy-frameworks.md, and ecommerce-creative.md; generates 2 visual direction variants per concept
• copy-writer: Framework-based copy with hook word validation and action verb CTAs
• visual-designer: 5-component banana formula replaces 7 preprocessing rules
• format-adapter: Added copy zone validation and cost tracking

Other Changes

• ads-photoshoot: Uses banana Product mode (Studio, Floating, Ingredient) and Editorial mode (In Use, Lifestyle) at 2K resolution
• Multi-screenshot brand DNA: ads-dna captures 3 screenshots (homepage, product page, about page) for richer brand anchoring
• Brand preset auto-creation: ads-generate creates a banana preset from brand-profile.json before generation
• Reference file count: 21 -> 23

Deprecated

• scripts/generate_image.py: Kept as fallback for environments without banana-claude. Use banana MCP tools instead.

Full Changelog: v1.3.0...v1.4.0

v1.3.0 — GAQL Accuracy Fixes, Validation Gates, Marketplace Support

What's New

GAQL Audit Accuracy Fixes (~600 false positives eliminated)

Upstreamed 10 audit accuracy improvements discovered by the akarls-web community fork:

• G03: False positives from zero-impression keywords, paused ad groups, match type duplication, stopword-only keywords (~18% reduction)
• G04: Multi-location campaign structures no longer over-count objectives
• G12: Search Partners logic corrected (flag OFF, not ON)
• G16/G-WS1: Wasted spend threshold raised to >$10 + 0 conversions
• G17/FL04: Legacy BMM detection — BROAD + Manual CPC = legacy BMM, not intentional broad
• G19: Visibility calculated from all terms before truncation
• G48/CT-FL5: Smart Campaign system conversions excluded
• G-CT1: HIDDEN/REMOVED conversion actions excluded from duplicate checks

Validation Gates (from PR #12)

Cherry-picked 6 data quality gates from Tessl's skill score improvements:

• Data availability and completeness checks before auditing
• Subagent score verification before aggregation
• Kill/scale decision thresholds (14-day minimum, 20-click/$100 minimum)

Google Ads MCP Integration

Optional automated data collection via google-ads-mcp with fallback to manual export.

Marketplace Support (Issue #14)

Added .claude-plugin/marketplace.json for plugin system discoverability.

New Reference: GAQL Compatibility Notes

gaql-notes.md documents known API field incompatibilities, deduplication patterns, and legacy BMM detection heuristics.

Dependencies

• actions/checkout v4 → v6
• actions/setup-python v5 → v6
• Pillow <12.0.0 → <13.0.0

Community

• Closed PRs #4, #5, #13 (out of scope)
• Cherry-picked PR #12 (Tessl) — 6 of 18 files
• Replied to Discussion #11
• Closed Issue #14

---

Full Changelog: v1.2.0...v1.3.0

v1.2.0 — Apple Search Ads, Context Intake, PS 5.1 Fixes

What's New

Added

• Apple Search Ads sub-skill (/ads apple): 35 checks across campaign structure (BOFU/MOFU/Search Match isolation), bid health (CPT vs install rate, CPA Goals), Creative Sets (Custom Product Pages), MMP attribution (AppsFlyer/Adjust/SKAdNetwork), budget pacing, TAP placement coverage (Today/Search/Product Pages), and goal CPA benchmarks by app category and country tier
• Context Intake: Claude now asks for industry, monthly spend, primary goal, and active platforms before any audit — ensures benchmarks match your actual situation
• Google Ads MCP reference in README for live API-connected audits
• FAQ section addressing top community questions (API login, benchmark accuracy, manual posting)

Fixed

• install.ps1: PowerShell 5.1 crash on git clone (git stderr treated as terminating error)
• uninstall.ps1: Unicode parse failure on non-UTF-8-BOM systems
• ads-google: Negative keyword guidance now enforces Exact/Phrase match — never Broad Match negatives
• ads/SKILL.md: Removed unsupported allowed-tools field; added license: MIT per spec

Installation

# Unix/macOS/Linux
curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-ads/main/install.sh | bash

# Windows PowerShell
irm https://raw.githubusercontent.com/AgriciDaniel/claude-ads/main/install.ps1 | iex

Usage

/ads audit        # Full multi-platform audit
/ads apple        # Apple Search Ads deep analysis (NEW)
/ads google       # Google Ads deep analysis
/ads meta         # Meta Ads deep analysis
/ads plan saas    # Strategic ad plan by business type

v1.0.0 — Initial Release

Claude Ads v1.0.0

Comprehensive paid advertising audit & optimization skill for Claude Code.

Quick Install

Unix/macOS/Linux:

curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-ads/main/install.sh | bash

Windows PowerShell:

irm https://raw.githubusercontent.com/AgriciDaniel/claude-ads/main/install.ps1 | iex

Highlights

186 Audit Checks

Platform	Checks	Key Areas
Google Ads	74	Search, PMax, Display, YouTube, Demand Gen
Meta Ads	46	Pixel/CAPI, Creative, Structure, Audience
LinkedIn Ads	25	B2B targeting, TLA, Lead Gen forms
TikTok Ads	25	Creative-first, Smart+, TikTok Shop
Microsoft Ads	20	Google import, Copilot, MSAN

Ads Health Score (0-100)

Weighted scoring with severity multipliers (Critical 5.0x, High 3.0x, Medium 1.5x, Low 0.5x) and A/B/C/D/F grading.

6 Parallel Audit Agents

Run /ads audit to spawn 6 specialized agents that analyze your ad accounts simultaneously — Google, Meta, Creative, Tracking, Budget, and Compliance.

11 Industry Templates

Strategic planning via /ads plan <type> with templates for SaaS, e-commerce, local service, B2B enterprise, info products, mobile app, real estate, healthcare, finance, agency, and generic businesses.

12 Sub-Skills

/ads google, /ads meta, /ads youtube, /ads linkedin, /ads tiktok, /ads microsoft, /ads creative, /ads landing, /ads budget, /ads plan, /ads competitor, /ads audit

Quality Gates

• Broad Match safety (never without Smart Bidding)
• 3x Kill Rule (flag CPA >3x target)
• Budget sufficiency checks per platform
• Learning phase protection
• Compliance auto-checks (Special Ad Categories)

12 Reference Files

2026-current benchmarks, bidding decision trees, platform specifications, compliance requirements, and conversion tracking guides — loaded on-demand via RAG pattern.

Architecture

~/.claude/skills/ads/              # Main orchestrator
~/.claude/skills/ads/references/   # 12 RAG reference files
~/.claude/skills/ads-*/            # 12 sub-skills
~/.claude/skills/ads-plan/assets/  # 11 industry templates
~/.claude/agents/audit-*.md        # 6 parallel audit agents

Requirements

• Claude Code CLI
• No additional dependencies

Related

• Claude SEO — SEO analysis skill for Claude Code