Ads Analyzer

Analyze extracted Meta ad creatives and generate a professional strategy report. Use after /meta_ads_extractor to produce a clean, organized analysis documen...

This skill appears to do what it says (analyze extracted Meta ad assets and build an HTML strategy report) and it's instruction-only (no installers), but there are a few practical and privacy-related issues to consider before installing or running it: - Telegram delivery ambiguity: SKILL.md tells the agent to 'Send via Telegram with caption' but the skill metadata lists no TELEGRAM_TOKEN, CHAT_ID, or delivery mechanism. Clarify how Telegram sending is implemented and where credentials would be provided; do not store tokens in plaintext. If you do not want reports sent off your machine, remove or disable the Telegram step. - Local tooling requirements: The instructions call out sips (macOS) and ffprobe. The skill metadata lists no required binaries — verify these tools exist on the host or adjust the workflow. Missing binaries could cause failures or show attempts to fallback to other commands. - Model access: The SKILL.md references a 'vision model' and 'Gemini' for analysis. Ensure you understand what model endpoints will be used and whether those calls send media off your machine (and whether your account/billing is used). If the agent will upload images/videos to external APIs, that can expose sensitive data. - Data exfiltration risk: The skill zips the extracted asset folder and instructs sending it externally. Review the assets for any PII or proprietary content before allowing transmission. Prefer manual review and manual transfer if you have concerns. - Operational practice: Run the skill in a controlled environment (isolated workspace or VM) the first time, and test with non-sensitive sample data. Ask the skill author (or verify code) how Telegram sending is implemented and where credentials are required; require explicit prompts before any external transmission. If the author can clarify how Telegram delivery is handled (where/when credentials are used), and list required binaries (ffprobe, sips or cross-platform alternatives), this would reduce the remaining concerns and raise confidence.

Type: OpenClaw Skill Name: meta-ads-analyser Version: 1.0.0 The skill is classified as suspicious due to significant vulnerabilities, primarily shell injection and Cross-Site Scripting (XSS) risks. The `SKILL.md` explicitly instructs the agent to execute shell commands (`sips`, `ffprobe`, `zip`) using filenames derived from input. If these filenames are not properly sanitized, they could lead to shell injection. Additionally, the `templates/report-template.html` uses placeholders for user-controlled content (e.g., ad copy, landing page text) without explicit mention of HTML escaping, posing an XSS risk in the generated report for the recipient. While the stated purpose is benign, these vulnerabilities could be exploited by malicious input data.