Siluzan Tso

当判断用户可能需要以下功能时可以使用siluzan-tso这个skillGoogle,Bing,Yandex,Tiktok,Kwai等广告账户的开户，账号数据分析共享/取消共享、Google MCC 绑定/解绑、Meta BM 绑定、TikTok BC 绑定/解绑TikTok 关闭、暂停 Google 账户撤回、...

Key points before installing or using this skill: - The SKILL.md runs a remote installer (curl|bash or irm|iex) from unpkg.com which will execute code on your machine; review that install script URL content before running it (do not run blind). - This skill manages and can close/pause advertising accounts — only provide credentials (TSO API key, platform tokens) that are appropriately scoped and revocable; avoid giving full admin credentials unless absolutely necessary. - The registry metadata does not declare required credentials, but SKILL.md references environment variables and a config with tokens — expect to supply a TSO API key/JWT and likely per‑platform authorizations; confirm what exact scopes and endpoints the CLI uses (check tsoApiBaseUrl and the install script). - Prefer manual install: fetch the installer, inspect it locally, and run in a controlled environment (isolated machine or container) if you must test. - If you will allow the agent to run commands, require explicit user confirmation for any destructive operation (account closing, unbinding, transfers) and review the exact commands the agent will execute. - If unsure, ask the skill author for: (1) the install script source code, (2) the CLI's network endpoints and data flows, (3) an explicit list of required environment variables and scopes; absence of these is a red flag. Given the remote install + broad account powers + undocumented credential needs, proceed cautiously — treat this as untrusted until you can audit the installer and confirm minimal, revocable credentials.

Type: OpenClaw Skill Name: siluzan-tso Version: 1.1.13 The skill bundle contains instructions in SKILL.md and setup.md for the AI agent to execute remote scripts using high-risk patterns, specifically 'bash <(curl -fsSL ...)' and 'npm install -g'. While these are intended to install the 'siluzan-tso-cli' tool, they represent a significant execution risk. The bundle also includes extensive AI behavioral guidelines and 'playbooks' that act as complex system prompts to control the agent's logic for managing advertising accounts. No clear evidence of intentional malice or data exfiltration was found; the behavior appears aligned with the stated purpose of advertising management, but the remote execution and broad tool permissions warrant a suspicious classification.