Performance Marketing Agent — Adspirer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

The skill is clearly for advertising account management, but it relies on an unpinned third-party plugin that can perform high-impact campaign and budget actions after authentication.

Review the Adspirer plugin source, version, publisher provenance, requested OAuth scopes, and platform audit logs before installing. Prefer a pinned reviewed plugin release, grant the narrowest ad-platform permissions possible, and confirm that campaign writes are paused by default and require explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Advertising Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–47 and 55–57
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: openclaw-adspirer
    kind: node
    label: "Adspirer Ad Management Plugin"

bash

# Install the plugin
openclaw plugins install openclaw-adspirer

Technical Analysis

The skill declares and instructs users to install the third-party openclaw-adspirer Node plugin without specifying an audited version, immutable source revision, package checksum, or cryptographic signature. Consequently, the code installed at execution time may differ from the code originally reviewed.

The plugin implementation and its transitive dependencies are not included in this project, so their security properties cannot be verified from the available artifact. This is particularly significant because the plugin is advertised as authenticating with multiple advertising platforms, accessing live campaign data, and performing campaign write operations.

This finding does not establish that the current plugin release is malicious. It identifies a supply-chain weakness through which a compromised publisher account, replaced package, malicious future release, or dependency confusion event could deliver unauthorized code.

Attack Path

1. An attacker compromises the package publisher, registry entry, release pipeline, or a transitive dependency associated with openclaw-adspirer.
2. The attacker publishes a malicious release under the same unversioned package identifier.
3. A user follows the documented command openclaw plugins install openclaw-adspirer.
4. The package manager resolves and installs the attacker-controlled release because no version or integrity value is enforced.
5. The plugin executes with the permissions of the OpenClaw process.
6. When the user authenticates advertising accounts, the malici ...[truncated 851 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openclaw-adspirer to a specific, reviewed version rather than resolving the latest available release.
2. Record and verify a cryptographic checksum, package-manager integrity value, or trusted publisher signature before installation.
3. Document the authoritative package registry and source repository so users can detect typosquatting or registry substitution.
4. Use a lockfile or equivalent immutable dependency manifest to pin all transitive dependencies.
5. Audit the plugin source and dependency tree for each upgrade, and deploy updates through a controlled review process.
6. Run the plugin in a restricted sandbox with minimal filesystem, network, and process permissions.
7. Grant only the minimum OAuth scopes required for the requested advertising operations and separate read-only access from write access where supported.
8. Enforce write confirmation and paused-by-default campaign creation outside the plugin, such as through a trusted policy layer, rather than relying solely on the external dependency.
9. Monitor advertising-platform audit logs and alert on unexpected campaign, bid, targeting, creative, or budget changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.