openclaw-marketing-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub repositories referenced are third‑party projects from relatively unknown accounts (potential distribution points for code/plugins), so they warrant caution as higher-risk download sources compared with official vendor/CDN links.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill package includes explicit connectors for ad platforms (google-ads-connect, meta-ads-connect) and requires API credentials (Google Ads client ID/secret/developer token/refresh token and Meta access token/ad account ID). The docs include example agent commands that perform account mutations (e.g., "Pause keywords with QS ≤ 3 and zero conversions"), which implies the agent can take actions that change ad campaigns and therefore control ad spend. This is a specific, non-generic integration with platforms that can modify financial/advertising settings, so it qualifies as direct financial execution risk (ad spend management).