NotFair Google Ads Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 2026.5.14

Overview

The skill is purpose-aligned for Google Ads management, but it delegates sensitive ad-account access and money-affecting changes to an unaudited, mutable third-party plugin and hosted service.

Review this before installing: it connects to Google Ads through NotFair and may support campaign, budget, bid, keyword, and ad changes after user approval. Only use it if you trust the NotFair plugin distribution and hosted MCP service, and prefer read-only analysis until you understand the account scopes and approval flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned and Unverifiable Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-42
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

    install:
      - id: openclaw-notfair
        kind: node
        label: "NotFair Google Ads Plugin"

text

## Setup

    openclaw plugins install openclaw-notfair

Technical Analysis

The skill directs users to install the third-party Node plugin openclaw-notfair using only a mutable package identifier. It provides no pinned version, integrity hash, authoritative source repository, or bundled implementation that could be reviewed as part of this audit.

Consequently, the code ultimately installed by the command may differ from the code that existed when the skill was reviewed. The risk is especially material because the subsequent workflow asks users to authenticate the plugin and connect it to Google Ads. The plugin is then expected to access advertising data and expose operations capable of modifying campaigns.

This finding does not establish that the current package is malicious. It identifies an unverifiable supply-chain boundary through which a compromised, replaced, or unexpectedly modified package version could be delivered.

Attack Path

1. An attacker compromises the package publisher, registry account, distribution channel, or another component involved in resolving openclaw-notfair.
2. The attacker publishes a modified release under the same mutable package identifier.
3. A user follows the documented command:

   text

   openclaw plugins install openclaw-notfair
   

4. Because no version or integrity digest is specified, the installer resolves and executes the attacker-controlled release.
5. The user follows the remaining setup instructions and authenticates or connects a Google Ads account.
6. The compromised plugin abuses its local execution context or authenticated advertising access to col ...[truncated 1109 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specifically reviewed version rather than installing it solely by mutable package name.
2. Require an immutable package integrity digest or cryptographic signature and make installation fail if verification does not succeed.
3. Document the authoritative package registry, publisher identity, source repository, release process, and security contact.
4. Make the plugin source available for review or vendor the audited implementation with the skill.
5. Lock transitive dependencies and use automated dependency, provenance, and malware scanning in the release pipeline.
6. Document all hosted MCP endpoints, data recipients, retention behavior, and subprocess or network capabilities.
7. Use minimum-privilege Google OAuth scopes and separate read-only analysis authorization from write authorization where supported.
8. Enforce write approval in trusted code outside model-controlled instructions. Bind every approval to the exact account, operation, entity set, values, and expiration time.
9. Prefer paused or draft resources for changes and verify the resulting Google Ads state after every approved mutation.
10. Provide package revocation and incident-response procedures so compromised releases can be blocked promptly.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.