lanbow-claw-skill

v1.0.5

End-to-end Meta (Facebook/Instagram) advertising system orchestrator covering the full ad lifecycle: strategy research, creative generation, campaign deliver...

2· 270·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill is an end-to-end Meta ads orchestrator and appropriately requires the lanbow-ads CLI and Meta credentials (META_ACCESS_TOKEN, META_APP_ID, META_AD_ACCOUNT_ID). However, the documentation references additional dependencies (e.g., a 'Gemini API Key' for creative generation) that are not declared in the skill's requires.env. That mismatch means the SKILL.md expects at least one more credential than the registry metadata lists.
Instruction Scope
SKILL.md instructs the agent to call the lanbow-ads CLI, fetch web data (WebSearch/WebFetch), generate creatives (external model key), collect campaign insights, and write structured report files. Those actions are consistent with the stated purpose. Flags: the skill explicitly instructs the agent to request and accept user-provided access tokens (and optionally app secret) and to save intermediate/output files to project directories — both are reasonable for this use-case but increase the surface where secrets or sensitive outputs might be exposed or persisted.
Install Mechanism
This is an instruction-only skill with no install spec; it expects the lanbow-ads binary to already exist. No third-party downloads or installers are used by the skill itself, which keeps install risk low. You should confirm the provenance of the lanbow-ads binary in your execution environment separately.
Credentials
Requested environment variables (META_ACCESS_TOKEN, META_APP_ID, META_AD_ACCOUNT_ID) are proportionate to an ad-delivery/orchestration skill. Caveat: SKILL.md also refers to other secrets (Gemini API key for creative generation, optional META_APP_SECRET for token exchange) but these are not listed in the required env metadata — an inconsistency. Also the instructions encourage pasting tokens if env/secret fields aren't available, which is functionally necessary but increases risk if done in chat.
Persistence & Privilege
always:false (good). The skill writes output and intermediate artifacts (report chapters, intermediate/) as part of its workflow which is normal for report generation. Be aware that persistent tokens configured into the agent's environment or CLI config will allow ongoing programmatic access to your ad account; paired with autonomous invocation (the platform default), that could let the agent act without repeated user confirmation. That is expected for an automation skill but worth conscious control.
Assessment
This skill appears to do what it says, but before you install/use it: (1) Do NOT paste long-lived or production Meta access tokens into chat if you can avoid it — prefer setting META_ACCESS_TOKEN, META_APP_ID, and META_AD_ACCOUNT_ID in your platform's secret store or environment variables. (2) If you must provide credentials interactively, prefer short‑lived tokens and rotate them after use; consider using a System User token for automation and grant only the minimum scopes required (ads_read/ads_management). (3) Confirm the lanbow-ads CLI binary that will run these commands is from a trusted source in your environment — the skill assumes it exists and will execute it. (4) Be aware the skill will create/update campaigns and can read campaign insights; review and monitor activity in Meta Business Manager and limit permissions if necessary. (5) Note the SKILL.md references a Gemini API key for creative generation but that variable isn’t declared in the registry metadata — if you plan to use creative generation, ask the skill author how that key should be provided and where it will be stored. (6) If you are uncomfortable with the agent taking autonomous actions that modify live campaigns, restrict or disable autonomous invocation for this skill and require explicit confirmations for deployment steps.

Like a lobster shell, security has layers — review code before you run it.

adsvk97a6my7pyfgk4ek459ej8pf0582rcmsads managervk97a6my7pyfgk4ek459ej8pf0582rcmsadvertisevk97a6my7pyfgk4ek459ej8pf0582rcmsadvertisementvk97a6my7pyfgk4ek459ej8pf0582rcmslanbowvk97a6my7pyfgk4ek459ej8pf0582rcmslatestvk97a6my7pyfgk4ek459ej8pf0582rcmsmarketingvk97a6my7pyfgk4ek459ej8pf0582rcmsmetavk97a6my7pyfgk4ek459ej8pf0582rcms

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📢 Clawdis
Binslanbow-ads
EnvMETA_ACCESS_TOKEN, META_APP_ID, META_AD_ACCOUNT_ID
Primary envMETA_ACCESS_TOKEN

Comments