Ad-Ready Pro

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears aligned with generating ad images, but users should know it uses a ComfyDeploy API key and sends selected product, logo, reference, and model images to external services.

This looks reasonable for its stated purpose. Before using it, be comfortable sharing the product URL and image assets with ComfyDeploy, use an appropriate API key, and review any automatically downloaded logo or reference images before relying on the output.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The generated ad may be based on web-sourced images or logos selected by the agent, which can affect accuracy, licensing, or brand suitability.

Why it was flagged

The skill asks the agent to perform web searches and downloads before running the generation. This is purpose-aligned, but it means the agent may choose external assets unless the user reviews or provides them.

Skill content
DOWNLOAD brand logo: → Search "{brand name} logo PNG" ... FIND reference image: → Search for "{brand name} advertisement" ... RUN the generation with ALL inputs filled
Recommendation

Provide approved product, logo, and reference images when possible, and review any auto-fetched assets before using the generated ad publicly.

What this means

Anyone running the skill with a real API key is authorizing ComfyDeploy uploads and generation jobs under that account.

Why it was flagged

The script uses a ComfyDeploy API key, which gives the skill delegated ability to upload files and queue generation runs on that account.

Skill content
return os.environ.get("COMFY_DEPLOY_API_KEY")
Recommendation

Use a dedicated or least-privileged ComfyDeploy key if available, and do not place the key in shared logs or public command history.

What this means

Running the helper may install or use external Python packages, which adds ordinary package-supply-chain exposure.

Why it was flagged

The script declares runtime Python dependencies with version lower bounds, and SKILL.md runs it through `uv`. This is normal for a Python helper script but depends on package resolution at run time.

Skill content
# dependencies = [
#     "httpx>=0.25.0",
#     "beautifulsoup4>=4.12.0",
# ]
Recommendation

Run it in a normal isolated project environment and, for production use, consider pinning dependency versions.

What this means

Product images, logos, reference ads, and any model/talent face images may leave the local environment and be processed by ComfyDeploy.

Why it was flagged

Local or downloaded image files are uploaded to the external ComfyDeploy API using the user's API key.

Skill content
response = client.post(
            f"{API_BASE}/file/upload",
            headers={"Authorization": f"Bearer {api_key}"},
            files=files
        )
Recommendation

Only provide assets you are allowed to share with ComfyDeploy, especially if using unreleased products, private brand materials, or real people’s faces.