schedule-ads
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
./secretcurlto interact with the AdManage.ai API. This is a standard practice for secure handling of API keys within this environment, as it prevents the key from appearing in the process tree or shell history. The command arguments are strictly controlled via declarative configuration files. - [DATA_EXPOSURE]: The skill requires
ADMANAGE_API_KEY, which is handled through the environment'srequiresdirective andsecretcurlmechanism. This is the recommended secure pattern for credential management in this platform. Sensitive state is stored locally in.admanage-state/campaigns.jsonand.pending-admanage/, which is appropriate for its purpose. - [COMMAND_EXECUTION]: The skill uses
python3for logic andjqfor JSON parsing. These are used for data processing (validating spend caps and computing configuration diffs) rather than dynamic code execution or arbitrary command injection. - [SAFE]: The skill implements a 'fail-closed' security posture for financial operations. For instance, if the daily spend cap cannot be verified due to an API error, the skill terminates rather than proceeding with potential ad launches.
Audit Metadata