Juliang Qianchuan Auto Ads V1

• Verdict: Advisory
• Analyzed: May 12, 2026, 4:37 PM
• Findings: 3
• Version: 1.2.6
• Reason codes:
  suspicious.dangerous_execsuspicious.exposed_secret_literal
• Engine: v2.4.24

Overview

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

ConcernHigh Confidence

What this means

If configuration or state is wrong, the agent could spend more ad budget or remove live ad plans without a fresh per-action confirmation.

Why it was flagged

The skill can automatically change bids and delete ad plans during monitoring, which are high-impact paid advertising account mutations.

Skill content

`direct_delete`：广告组名称、广告组 ID、计划 ID、计划名全匹配时直接删除；... 连续 15 分钟消耗不增长：出价提高 5%，最高 1.00

Recommendation

Default to require_confirmation for deletion and bid changes, require explicit confirmation before every paid-account mutation, and set hard daily spend/bid limits.

ASI03: Identity and Privilege Abuse

ConcernMedium Confidence

What this means

A real embedded secret could expose or reuse a Feishu application credential across customers, weakening account isolation.

Why it was flagged

The static scan reports a client_secret literal in the Feishu setup script, while the documentation says App Secrets should only be obtained during customer authorization and stored locally.

Skill content

client_secret: "[REDACTED]"

Recommendation

Verify the file contains no real secrets, replace any literals with placeholders or runtime-generated values, and declare Feishu/Qianchuan credential requirements in metadata.

ASI04: Agentic Supply Chain Vulnerabilities

ConcernHigh Confidence

What this means

Users may be asked to run installer code that is not present in, or reviewable from, the supplied package, while that installer path is supposed to change OpenClaw configuration and services.

Why it was flagged

The Windows instructions ask users to run a PowerShell bypass installer, but the reviewed manifest does not include INSTALLER-MAIN.ps1 or the referenced RUN-ME-FIRST entrypoints.

Skill content

powershell -NoProfile -ExecutionPolicy Bypass -NoExit -File .\INSTALLER-MAIN.ps1

Recommendation

Publish a complete manifest with all installer entrypoints, avoid ExecutionPolicy Bypass where possible, and ensure ClawHub install metadata matches the actual setup path.

ASI05: Unexpected Code Execution

NoteHigh Confidence

What this means

Installing the skill can modify local OpenClaw state rather than only adding prompt text.

Why it was flagged

The installer runs local OpenClaw CLI commands, which is expected for this deployment workflow but gives the package local execution authority.

Skill content

const result = spawnSync("openclaw", args, {

Recommendation

Run the installer only from a trusted package, review the printed actions, and prefer dry-run or manual setup before granting it access to production accounts.

ASI06: Memory and Context Poisoning

NoteHigh Confidence

What this means

If these state files are corrupted or edited incorrectly, the agent may target the wrong plan, block valid work, or make unsafe monitoring decisions.

Why it was flagged

Persistent local memory/state files drive future deduplication, monitoring, and mutation decisions.

Skill content

本地台账是 `memory/qianchuan-plan-registry.json`；查重必须同时覆盖计划名称和 `行为类目词 + 兴趣类目词` 组合

Recommendation

Protect the workspace files, back them up, and validate state before allowing publish, bid, delete, or stop-monitoring actions.

ASI07: Insecure Inter-Agent Communication

NoteHigh Confidence

What this means

If Feishu permissions or chat routing are too broad, an unintended user or group could trigger ad workflow commands.

Why it was flagged

The workflow connects OpenClaw to Feishu bot messages and active notifications, so message origin and chat allowlisting matter.

Skill content

记录当前会话 target：`user:ou_xxx` 或 `chat:oc_xxx` ... 测试一次主动通知

Recommendation

Use a dedicated Feishu bot, keep direct-message allowlisting enabled, disable group use unless necessary, and verify owner_open_id/chat_id before production use.

ASI10: Rogue Agents

ConcernHigh Confidence

What this means

Background monitoring may continue to act on ad accounts until stopped or until its state says the live session has ended.

Why it was flagged

The skill sets up long-running gateway/monitoring behavior that continues after the initial command and can affect live ad operations.

Skill content

安装并启动 Gateway ... 每 15 分钟监控消耗与点击 ... 直播结束后停止监控

Recommendation

Make the running monitor visible to the user, provide a simple stop command, and require confirmation before any background task mutates ads.

Findings (3)

critical

suspicious.dangerous_exec

• Location: scripts/install-qianchuan-client.js:310
• Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

• Location: workspace-template/bin/feishu_oneclick_setup.js:113
• Finding: Shell command execution detected (child_process).

critical

suspicious.exposed_secret_literal

• Location: workspace-template/bin/feishu_oneclick_setup.js:229
• Finding: File appears to expose a hardcoded API secret or token.