广告素材搜索助手。当用户提到"找素材"、"搜广告"、"广告视频"、"创意素材"、"竞品广告"、"ad creative"、"search ads" 等关键词时触发。
Security Analysis
medium confidenceThe skill's stated purpose (search ad creatives) matches most of its requirements, but the install/runtime instructions download and run arbitrary Python code and modify local mcporter configuration — review the downloaded files and API key usage before installing.
Name/description (AdMapix ad creative search) align with needing a CLI (mcporter) and an API key for the AdMapix service. Declaring workspace/_user_context.json to enable an optional 'delivery' feature is plausible. The combination of a node 'mcporter' CLI that calls a local Python MCP server is unusual but explainable.
Runtime instructions require running mcporter CLI and (if missing) downloading and running a Python server (server.py). The skill instructs reading ~/.openclaw/workspace/_user_context.json to extract externalUserId/channel — that file may contain sensitive user context and will be read and passed to the remote service if present. The instructions also tell the agent to prompt the user for an API key and then persist it into ~/.mcporter/mcporter.json (local configuration).
If mcporter is not present the SKILL.md downloads server.py and requirements.txt from a GitHub raw URL and pip-installs dependencies into a new virtualenv under ~/.admapix. Downloading and executing arbitrary GitHub raw code and installing pip packages represents a moderate-to-high risk and should be audited. The node package 'mcporter' install declared in metadata is reasonable for the CLI, but the mixed node+Python install flow increases complexity and attack surface.
Only API_KEY is declared as required (primaryEnv) which is appropriate for a third‑party search service. However, the install writes that API key into the mcporter config file and the instructions' Python snippet appears to write the literal string '<API_KEY>' (the SKILL.md says 'replace' but the shown code does not interpolate) — this is an inconsistency you should clarify. Reading the workspace/_user_context.json is declared but means user context could be sent to the service as delivery parameters.
The skill modifies user-local configuration (~/.mcporter/mcporter.json) and writes files under ~/.admapix; it does not request system-wide or 'always' privileges. Persisting an API key in mcporter config is expected for a client, but is a privileged action that should be done only after user review.
Guidance
This skill is largely coherent with its advertised purpose, but exercise caution before installing/accepting the install steps. The SKILL.md instructs you to: (1) provide an API key and have it written into ~/.mcporter/mcporter.json, (2) download server.py and requirements.txt from a GitHub raw URL and pip-install them into ~/.admapix, and (3) allow the skill to read ~/.openclaw/workspace/_user_context.json to enable an optional 'send to chat' button. Before proceeding: review the raw files (server.py and requirements.txt) in the referenced GitHub repo to ensure they are safe, verify the npm 'mcporter' package provenance, do not give your primary/privileged API key if unsure (use a limited-scope/test key if possible), and confirm the skill will not exfiltrate sensitive fields from _user_context.json. Also note the SKILL.md shows a python snippet that writes '<API_KEY>' literally — ask the skill author to clarify how your provided key is substituted and stored securely. If you cannot audit the downloaded code, avoid running the install steps.
Latest Release
v1.0.1
Significantly revised install and environment check process for easier, no-root setup: - 安装流程改为仅本地 user 级别，无需 root、支持 Python 虚拟环境，安全可审计 - MCP Server/AdMapix 配置改为直接下载 server.py 并用 venv 运行，无需全局安装 - 检查和自动提示 Python 3.10+ 环境，不满足时给出安装说明 - skill metadata 增加 requires.config（自动传入 user context 信息供 delivery 参数使用） - 安装和配置流程细节优化，支持覆盖/复用老配置并显示操作进度与成功提示 - 交互、本地依赖声明和安装提示文案细节优化，提升易用性
More by @fly0pants
Published by @fly0pants on ClawHub
