AdWhiz
v2.3.0Manage Google Ads & Meta (Facebook) Ads from your AI coding tool. 102 MCP tools for auditing, creating, and optimizing ad accounts using natural language.
⭐ 1· 1.1k·3 current·3 all-time
byOrris@iamzifei
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (manage Google Ads & Meta Ads) aligns with the declared single credential (ADWHIZ_API_KEY) and the SKILL.md describes a hosted MCP proxy at mcp.adwhiz.ai. Requiring a single vendor API key for a hosted proxy is proportionate to the stated purpose.
Instruction Scope
SKILL.md instructs the agent to use the AdWhiz hosted MCP service and to link ad accounts via the provider's web UI; it does not request other system files or additional environment variables in the provided excerpt. Because the skill is instruction-only and the full SKILL.md was truncated, confirm that no instructions later in the document ask the agent to read unrelated files or environment variables before installing.
Install Mechanism
No install spec and no code files are included, so nothing is written to disk by the skill itself. This is the lowest-risk install profile, but it means all logic runs remotely on the AdWhiz server.
Credentials
Only ADWHIZ_API_KEY is required (declared as primaryEnv), which is appropriate for a hosted proxy. However, that single key delegates potentially broad read/write control of your ad accounts to the third party — verify the key's scope, revocation controls, and whether the provider supports read-only or scoped keys.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent presence or to modify other skills. Autonomous invocation is allowed by platform default but write tools are described as requiring user confirmation.
Assessment
This skill appears coherent: it acts as a hosted proxy and asks only for an ADWHIZ_API_KEY. Before installing, verify the provider (https://adwhiz.ai) and the referenced GitHub repo, confirm the ADWHIZ_API_KEY scope and revocation process, and prefer creating a scoped/read-only key if available. Test with read-only queries first and review the provider's audit/logging and privacy policy (how they store OAuth tokens and what data is retained). Because the skill is instruction-only (no local code), trust in the remote service is the main risk — if you need stronger assurance, ask the vendor for an auditable security statement or run through their connect flow in a throwaway/test ad account first.Like a lobster shell, security has layers — review code before you run it.
advertisingvk97f7h7abygch69n13462zqh6182esebgoogle-adsvk97f7h7abygch69n13462zqh6182eseblatestvk971prm6awb76fthxhqsgpjzz983n2vpmcpvk97f7h7abygch69n13462zqh6182esebmeta-adsvk97f7h7abygch69n13462zqh6182eseb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvADWHIZ_API_KEY
Primary envADWHIZ_API_KEY