Adspirer Ads Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:49 PM UTC
• Version: 1.5.0

Overview

The skill is transparent about managing real ad accounts, but it should be reviewed because it delegates high-impact ad-account control to an unpinned external plugin.

Review the Adspirer plugin and OAuth scopes before installing, and connect only the ad accounts you are comfortable letting it read and manage. Keep write actions behind explicit confirmation, check campaigns before enabling spend, and pay attention to scheduled monitors or reports that may continue running after setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54
• Finding: Unpinned Third-Party Node Plugin Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54-60`, `SKILL.md:74-78`, `SKILL.md:364`, and `claw.json:55-62` **Vulnerability Type**: Unverified and unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:54-60`: ```yaml install: - id: openclaw-adspirer kind: node label: "Adspirer Ad Management Plugin" ``` `SKILL.md:74-78`: ```bash # Install the plugin openclaw plugins install openclaw-adspirer ``` `SKILL.md:364`: ```markdown | Plugin not installed | `openclaw plugins install openclaw-adspirer` | ``` `claw.json:55-62`: ```json "install": [ { "id": "openclaw-adspirer", "kind": "node", "label": "Adspirer Ad Management Plugin" } ] ``` ### Technical Analysis The audited package instructs users to install and execute the external Node plugin `openclaw-adspirer`, but it does not pin an exact package version, provide a cryptographic integrity hash, include a lockfile, or vendor the plugin source for review. The implementation of that dependency is absent from the audited artifact. Consequently, the code ultimately executed can differ from the content reviewed here. A compromised package publisher account, malicious future release, package-registry compromise, or dependency-resolution attack could introduce attacker-controlled code after this Skill has already been approved. This dependency is particularly sensitive because the documented plugin authenticates to advertising platforms and exposes write operations for campaigns, advertisements, keywords, bids, and budgets. Although the Skill text requires user confirmation and states that new campaigns are paused, those controls are instructions in `SKILL.md`; they cannot independently constrain a malicious plugin implementation. No evidence in the audited files establishes that the current external plugin is malicious. The finding concerns the unpinned and unverifiable supply-chain trust boundary. ### Attack Pat ...[truncated 1888 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `openclaw-adspirer` to an exact, reviewed version rather than resolving a mutable package name. 2. Require and verify a cryptographic integrity digest for the distributed package. 3. Include a lockfile that pins all transitive dependencies and their integrity values. 4. Publish reproducible build instructions, signed release artifacts, and package provenance attestations. 5. Vendor the reviewed plugin source into the audited distribution or make the precise source revision corresponding to each release independently verifiable. 6. Enforce publisher protections, including multifactor authentication, protected release workflows, and narrowly scoped registry tokens. 7. Document the exact host permissions, network destinations, and OAuth scopes requested by the plugin. 8. Apply runtime least privilege so the plugin cannot access unrelated files, environment secrets, processes, or network destinations. 9. Implement write-operation confirmation and spend limits in trusted host-side enforcement rather than relying only on natural-language instructions. 10. Require explicit security review before dependency upgrades and monitor the package and its transitive dependency graph for compromise or ownership changes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

4. All campaigns are created in **PAUSED status** for user review
5. Avoid policy-violating keywords: health conditions, financial hardship, political topics, adult content
6. When in doubt about any spend-affecting action, **ask the user first**
7. Read operations (performance data, keyword research, analysis) are safe to run without confirmation
8. Write operations (create, update, pause, resume, delete) always need user confirmation

---

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manifest summary and description do not warn users that the skill can access live advertising data and perform real modifications to campaigns and budgets. Because this skill operates in a financial and account-management context, missing warnings can cause users or orchestrating agents to treat it like a harmless informational tool and accidentally authorize costly or sensitive actions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description advertises broad natural-language management of ad campaigns across multiple live advertising platforms without stating meaningful scope boundaries or trigger constraints. In a high-impact domain where actions can spend money, change campaigns, and access performance data, this increases the risk that a user or upstream agent invokes the skill for unintended live operations.

Static analysis

No suspicious patterns detected.