google-ads-api-setup

SUSPICIOUS. The core purpose is legitimate and the Google API/YAML flow is consistent with official Google tooling, but the install trust is weaker than ideal because users clone and execute scripts from an unpinned third-party GitHub repo. The skill also asks for broader OAuth scopes than pure Ads setup and stores highly sensitive refresh tokens locally in plaintext for reuse by other skills. No clear evidence of malicious exfiltration is present, but the credential scope and third-party script trust make this medium risk.