📢 Microsoft Ads MCP — 管理广告
v1.0.0通过 MCP 服务器创建并管理 Microsoft Advertising 广告系列，支持 Bing Ads 与 DuckDuckGo Ads，涵盖广告组、关键字、创意及报表全流程。
3· 2.2k·1 当前·2 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions broadly match its advertised purpose (managing Microsoft Advertising via an MCP server), but the package metadata omits several operational requirements (mcporter, config path, and credentials) and the runtime steps ask you to clone and run third‑party code and store sensitive tokens — discrepancies and remote-code risks merit caution.
评估建议
This skill appears to do what it claims (manage Microsoft Ads via an MCP server) but several operational details are missing or inconsistent in the registry metadata. Before installing or running it: 1) Inspect the GitHub repo (https://github.com/Duartemartins/microsoft-ads-mcp-server) and review server.py and requirements.txt for any unexpected behavior or risky dependencies. 2) Confirm you want to install and run third‑party Python code on your machine and understand where credentials and OAut...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes a Microsoft Advertising MCP server and shows mcporter-based commands for campaign management — that aligns with the skill name/description. However, the skill registry metadata claims no required binaries, env vars, or config paths, while the SKILL.md clearly requires the 'mcporter' command and a ~/.mcporter/mcporter.json config entry. This mismatch suggests the declared requirements are incomplete.
⚠ 指令范围
The instructions tell the user to git clone https://github.com/Duartemartins/microsoft-ads-mcp-server, pip install requirements, configure ~/.mcporter/mcporter.json with credentials, and run mcporter calls (including an OAuth flow). Those steps are coherent with the advertised functionality, but they require writing and executing third‑party code, creating/storing credentials in a local config file, and running a long‑running server process — none of which are declared in the skill metadata. The instructions also rely on the user pasting redirect URLs (OAuth codes), and they do not specify where long‑term tokens are persisted, which is a scope/capability detail left unspecified.
ℹ 安装机制
This is an instruction-only skill (no bundled install). The instructions instruct cloning a GitHub repo and pip installing requirements.txt. GitHub and pip are common sources, but installing and running arbitrary code from a third‑party repo introduces moderate risk — review the repository and requirements.txt before installing. No unusual or obfuscated URLs are used, but the skill does rely on external code execution.
⚠ 凭证需求
Functionally the skill needs Microsoft Ads developer token and Azure AD app client ID (and an OAuth flow) which are appropriate for this integration. However, the registry lists no required env vars or primary credential while the instructions explicitly instruct the user to place credentials into ~/.mcporter/mcporter.json env fields. Storing tokens/keys in a plaintext config under the user's home directory may expose sensitive data if not handled carefully. The skill doesn't document where OAuth tokens/refresh tokens are stored or how they are protected.
ℹ 持久化与权限
The skill itself is not marked 'always' and is user-invocable, which is appropriate. But the runtime instructions create persistent artifacts (a cloned repo, installed Python packages, and a mcporter-configured stdio server process) that will live on disk and may run locally. The skill package metadata does not declare that it will create these artifacts, so users should be aware that installing/running the server has persistence implications on their machine.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/27
Initial release
● 可疑
安装命令
点击复制官方npx clawhub@latest install microsoft-ads-mcp
镜像加速npx clawhub@latest install microsoft-ads-mcp --registry https://cn.longxiaskill.com