Manage ad accounts (广点通, 巨量引擎) via browser automation with cookie login. Invoke when user asks to manage ad accounts, login to ad platforms, or view account...

This skill appears to do what it says: it opens the ad platform login pages, lets you scan to log in, captures cookies, and saves them locally for one-click logins. Before installing, consider: (1) cookie sensitivity — saved cookies in data/accounts.json are effectively account access tokens and are stored unencrypted; protect or encrypt that folder, or run the skill in an isolated environment/VM; (2) installation: you must install Playwright and run 'playwright install chromium', which downloads browser binaries from the internet; review that step and network policy; (3) confirm you trust the origin of this skill (source unknown) before giving it access to any machine or account data; (4) if you need stricter security, request the author add encrypted storage for cookies, an option to store data outside the project folder, and an audit/log of account actions. Overall the package is coherent with its purpose, but cookie handling and the required browser install are the main risks to mitigate.

Type: OpenClaw Skill Name: ad-account-manager Version: 1.0.0 The skill manages sensitive advertising account sessions by capturing and storing login cookies for platforms like Guangdiantong and Ocean Engine. While this behavior is clearly aligned with the stated purpose in SKILL.md and README.md, the implementation stores these high-value session cookies in plaintext within a local file (data/accounts.json in ad_manager.py). This constitutes a significant security vulnerability (session hijacking risk) which, per the analysis guidelines, warrants a suspicious classification despite the lack of evidence for intentional data exfiltration or malicious logic.