Ad Creative
v0.1.0When the user wants to generate, iterate, or scale ad creative — headlines, descriptions, primary text, or full ad variations — for any paid advertising plat...
⭐ 1· 342·9 current·9 all-time
byVictor Huang@mrhuang09
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description and the SKILL.md are coherent: the skill focuses on generating and iterating ad creative and provides platform specs, workflows, and references to generative image/video/voice tools. Referenced capabilities (copy + visuals + video + voice cloning) are consistent with the stated purpose.
Instruction Scope
The runtime instructions tell the agent to read local product-marketing-context files (.agents/product-marketing-context.md or .claude/...) if present, to ingest user-provided performance data (CSV/paste/API outputs), and to call numerous external generative services. That scope is reasonable for an ad-creative skill, but the instructions include explicit API examples (e.g., curl using $GEMINI_API_KEY) and recommend voice cloning and external video/image services — none of which are declared as required credentials. Reading workspace files and processing performance data is expected, but you should be aware the skill will access local context files if present and could send content to external provider APIs.
Install Mechanism
Instruction-only skill with no install spec and no code files: lowest install risk. Nothing will be written to disk by an installer because there is no install mechanism declared.
Credentials
The skill declares no required environment variables or credentials, yet the documentation and examples reference multiple third‑party APIs (Gemini, Ideogram, ElevenLabs, Runway, OpenAI, Replicate, etc.) and show examples that use API keys. This is a mismatch: to actually call those services the agent will need credentials, but the skill doesn't list which ones it expects, nor their scope. That increases the chance you'll be asked to supply broad API keys at runtime without clear justification or least-privilege guidance.
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges. There is no indication it modifies other skills or agent-wide settings. Autonomous invocation is allowed (platform default) but not combined with other elevated privileges.
What to consider before installing
This skill appears to do what it says (generate and iterate ad creative) but relies heavily on external generative services and will read a local product-marketing-context file if present. Before installing or providing keys: (1) ask the author which exact API keys/credentials the skill will request and why, and prefer scoped/limited keys or short-lived tokens; (2) avoid supplying highly privileged or personal cloud credentials — use service-level API keys only; (3) be cautious about providing voice-cloning data or personally identifiable material without consent; (4) inspect any .agents/product-marketing-context.md file contents (it may contain sensitive marketing/customer info) before allowing the skill to read it; (5) if you enable the agent to call external APIs, restrict autonomous invocation or monitor outbound requests and revoke keys after testing; (6) ask the maintainer to declare required env vars and exact endpoints in SKILL.md so permission decisions are informed.Like a lobster shell, security has layers — review code before you run it.
latestvk9752yb0d1xyqafc6xerw2283x82ayvn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.