by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears coherent for ad management, but before installing: 1) verify the plugin ID 'openclaw-adspirer' is the official Adspirer plugin (check the publisher and source repo or package registry); 2) confirm the exact OAuth scopes requested during 'openclaw adspirer login' (least privilege — only grant what is needed); 3) check whether tokens are stored and where (SKILL.md claims no local credential storage and PKCE, but verify in plugin docs); 4) test in a non-production account or with...详细分析 ▾
✓ 用途与能力
Name/description describe an ad-management agent and the SKILL.md only asks you to install an 'openclaw-adspirer' plugin and perform OAuth connections to ad platforms — these requirements are coherent with the stated purpose.
ℹ 指令范围
Instructions are limited to installing the plugin, running 'openclaw adspirer login' and connecting ad accounts (OAuth/PKCE). The doc explicitly says write operations require confirmation and campaigns are created paused, which limits risk. No instructions ask the agent to read unrelated local files or environment variables.
✓ 安装机制
Install is declared as a node plugin (id: openclaw-adspirer). No arbitrary download URLs or archive extraction are present in the SKILL.md. Because the skill is instruction-only, the actual plugin code will be installed at runtime by the OpenClaw plugin command — review that plugin before installing.
✓ 凭证需求
No environment variables, credentials, or config paths are requested in the manifest. Authentication is described as OAuth 2.1 with PKCE via the plugin/site, which is appropriate for connecting ad platforms.
ℹ 持久化与权限
always is false and model invocation is enabled (default). Autonomous invocation plus a plugin that can call external ad APIs increases blast radius, but SKILL.md claims user confirmation for writes and paused campaign creation; still verify plugin behavior and OAuth scopes before granting access.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/1
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install performance-marketing-agent
镜像加速npx clawhub@latest install performance-marketing-agent --registry https://cn.longxiaskill.com