marketing-skills

Least-privilege permissions

• Create separate API keys for Google Ads and Meta instead of using master account credentials. Each key should only control the specific ad accounts and campaigns it needs, not entire company billing.
• Restrict Claude skill access by limiting which team members can run marketing tasks, and disable skills you're not actively using (e.g., turn off SEO tools if you only need Ads management).
• Set monthly spend caps in Google Ads and Meta at the account level—this is your hard limit if the agent malfunctions or gets tricked into escalating budgets.
• Rotate API keys quarterly and immediately revoke any key if an employee leaves or if you suspect exposure.

Network isolation

• Use Ryze MCP only over HTTPS (verify the connector URL uses https:// not http://) to encrypt all data traveling between Claude and your ad platforms.
• Don't paste sensitive campaign data directly into chat prompts—instead, have Claude query only the metrics and reports it needs through the API connections; keep competitor insights and internal strategy documents out of conversations.
• Keep marketing agent conversations separate from other Claude projects to limit cross-contamination if one skill is compromised.

Monitoring

• Enable audit logs in Google Ads and Meta to track all changes: who modified campaigns, when, and what budget amounts changed. Review weekly for unauthorized activity.
• Set up alerts for unusual spend spikes (e.g., daily budget increasing >20% or multiple campaigns paused/resumed in one hour).
• Log Claude skill outputs in a secure location—capture what the agent recommended and what humans approved, so you can trace decisions if something goes wrong.

Red flags to watch for

• Ad copy or performance data looks corrupted or nonsensical (e.g., garbled text in campaign reports or metrics that contradict previous days)—this may signal prompt injection trying to manipulate the agent.
• Unexpected campaign changes you didn't approve, such as audience targeting widened, budgets increased, or ads paused without your request.
• Ryze MCP goes offline or API responses are delayed consistently—this breaks your safety checks; pause automation and switch to manual control until service is confirmed stable.
• New or unfamiliar API calls appearing in audit logs, especially ones accessing archived campaigns, budget transfer features, or account settings outside your normal workflow.