Setv.Wang

Manage ad accounts (广点通, 巨量引擎) via browser automation with cookie login. Invoke when user asks to manage ad accounts, login to ad platforms, or view account...

Security Scan

The code and instructions match the stated purpose (browser-automated ad account management), but it stores sensitive cookies locally and requires installing Playwright/browser binaries — review storage and install choices before use.

Purpose & Capability

The skill's name/description (manage 广点通/巨量引擎 via browser automation) aligns with the included Python modules: browser automation (Playwright), cookie capture/storage, one‑click login, and account overview. The files implement exactly those capabilities and don't request unrelated services or credentials.

Instruction Scope

SKILL.md and README instruct browser automation and cookie saving; runtime code navigates to platform login URLs, waits for QR login, captures cookies, and later reuses them. The instructions and code do not read unrelated system files or environment variables and do not send data to external endpoints beyond visiting the ad platforms. However, cookies are saved to local disk (data/accounts.json) without encryption — this is expected for the feature but is a sensitive action and should be considered carefully.

Install Mechanism

Registry has no formal install spec, but repository includes requirements.txt listing playwright>=1.40.0 and README instructs 'playwright install chromium'. Playwright installation will download browser binaries from the Playwright hosts; this is standard for Playwright but is a networked install step that writes binaries to disk. No obscure download URLs or extract-from-personal-server patterns are present.

Credentials

The skill declares no required environment variables or external credentials, which is consistent. It does, however, collect and persist authentication cookies for ad platforms — effectively long‑lived credentials. The number and type of env/credential requests are proportionate, but cookie storage is sensitive and currently done unencrypted in a local JSON file.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide agent settings, and its persistence is limited to creating/reading a local data/accounts.json under its module directory. Autonomous invocation is allowed (platform default) but not combined with other red flags.

Assessment

This skill appears to do what it says: it opens the ad platform login pages, lets you scan to log in, captures cookies, and saves them locally for one-click logins. Before installing, consider: (1) cookie sensitivity — saved cookies in data/accounts.json are effectively account access tokens and are stored unencrypted; protect or encrypt that folder, or run the skill in an isolated environment/VM; (2) installation: you must install Playwright and run 'playwright install chromium', which downloads browser binaries from the internet; review that step and network policy; (3) confirm you trust the origin of this skill (source unknown) before giving it access to any machine or account data; (4) if you need stricter security, request the author add encrypted storage for cookies, an option to store data outside the project folder, and an audit/log of account actions. Overall the package is coherent with its purpose, but cookie handling and the required browser install are the main risks to mitigate.

广告账户管理 Skill

功能描述

通过浏览器自动化（Cookie登录），实现多平台广告账户的统一管理，无需逐个登录广告后台，提升账户切换和状态查看效率。

核心功能

1. 登录管理：支持广点通（广告主/服务商）和巨量引擎的扫码登录，保存Cookie到本地
2. 一键登录：使用已存储的Cookie自动登录对应广告后台
3. 账户状态总览：拉取所有已登录账户的基础信息，异常账户标红提醒

使用场景

• 用户发送"管理广告账户"
• 用户请求登录广点通或巨量引擎
• 用户需要查看账户状态（余额、消耗、预算等）