Apple Search Ads
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill matches Apple Search Ads management, but it gives an agent power to change paid ad campaigns and use local Apple Search Ads credentials without enough declared guardrails.
Install only if you trust the asa-cli tool and are comfortable giving the agent access to your Apple Search Ads account. Use least-privileged credentials, verify the selected profile and org ID, and require manual review before any command that creates, updates, deletes, changes status, changes bids, or changes budgets.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A mistaken or overbroad agent action could change ad spend, pause live campaigns, or delete campaign data.
These commands let an agent create, modify, pause, or delete paid advertising campaigns and budgets. The supplied artifact does not add confirmation or safety checks before these high-impact mutations.
asa-cli campaigns create ... --budget 1000 --daily-budget 50 ...; asa-cli campaigns update ... [--budget ...] [--daily-budget ...] [--status ENABLED|PAUSED]; asa-cli campaigns delete <id>
Require explicit user approval for create, update, delete, bid, budget, and status changes; verify org ID, campaign ID, budget, and bid values before execution; prefer read-only/reporting commands unless the user clearly asks for a mutation.
The agent may act with the privileges of the configured Apple Search Ads account, potentially across organizations or profiles if the wrong org/profile is selected.
The skill uses Apple Search Ads credentials, private key paths, named profiles, and a persistent token cache, but the registry metadata declares no primary credential or required environment variables.
asa-cli configure --client-id ... --team-id ... --key-id ... --private-key-path ...; Config stored at `~/.asa-cli/config.yaml`, token cache at `~/.asa-cli/token_cache.json`
Use least-privileged Apple Search Ads credentials, keep private keys and token cache files protected, declare the credential contract in metadata, and require users to choose the intended profile and org before account-changing actions.
If asa-cli is missing, outdated, or shadowed by an untrusted binary on PATH, the agent could fail or run an unexpected program with advertising-account credentials.
The SKILL.md depends on asa-cli, and also recommends jq, but the package does not declare where those tools should come from or that they are required.
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill; Required binaries: none
Install asa-cli only from a trusted source, pin or verify the version where possible, and update the skill metadata to declare required binaries and trusted setup instructions.