by 安全扫描
OpenClaw
安全
medium confidenceThe skill’s description, instructions, and requested capabilities align: it drives an external Adspirer plugin that will read and write ad accounts; the primary residual risk is installing an external Node plugin (supply-chain/network) rather than any incoherence in purpose.
评估建议
This skill is internally coherent for managing ad accounts, but it relies on installing an external Node plugin (openclaw-adspirer) that will communicate with adspirer domains and act on your ad accounts. Before installing: verify the plugin source (homepage/repo), review the OAuth scopes requested during the 'connect' flow, read Adspirer’s privacy policy, and prefer testing on a non-production ad account. If you need maximum assurance, ask for a pinned release or review the plugin package conte...详细分析 ▾
✓ 用途与能力
The name/description (ad campaign management across Google, Meta, LinkedIn, TikTok) matches the instructions: the skill instructs the agent to install an Adspirer plugin and then directly call ad-platform tools to read metrics and create campaigns. No unrelated credentials or unrelated platform access are requested in the SKILL.md or claw.json.
✓ 指令范围
SKILL.md explicitly instructs installing the openclaw-adspirer plugin, authenticating via Adspirer, and then invoking platform-specific tools that read/write ad accounts. This is in-scope for an ad management agent. Note: the agent will perform live actions on user ad accounts (create/modify campaigns) and therefore requires explicit user OAuth consent at runtime — the instructions correctly emphasize login/connect steps.
ℹ 安装机制
Install is declared as kind: node (openclaw-adspirer). Because this is an instruction-only skill that delegates functionality to an external Node plugin, installing will fetch code from an external source (npm/registry or a remote URL). The claw.json lists repository/homepage domains consistent with Adspirer, but there is no explicit registry URL or pinned release in SKILL.md. This is expected for a plugin but represents a normal supply-chain/network risk (external code will run).
✓ 凭证需求
The skill declares no required environment variables or secrets and the SKILL.md does not request unrelated credentials. Account access is handled via the plugin's login/connect flow (OAuth-like), which is appropriate for an ad-management tool.
✓ 持久化与权限
always:false and user-invocable:true. The skill does not demand permanent/always-on presence and does not claim to modify other skills or system-wide settings. Autonomous invocation (disable-model-invocation:false) is the platform default and not by itself a red flag.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.5.02026/2/19
Add marketing use cases for improved search discoverability
● 可疑
安装命令
点击复制官方npx clawhub@latest install adspirer-ads-agent
镜像加速npx clawhub@latest install adspirer-ads-agent --registry https://cn.longxiaskill.com