pmax-builder
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates legitimate marketing automation workflows. The code does not perform any unauthorized data exfiltration or malicious actions.
- [EXTERNAL_DOWNLOADS]: The skill downloads its constituent scripts and configuration templates from the author's public GitHub repository. These downloads are part of the standard installation process and target trusted sources related to the developer.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute local Python scripts and shell commands to interact with the Google Ads API (read-only) and generate CSV files. These operations are scoped to the local filesystem and the user's provided credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources such as campaign briefs, Google Sheets, and scraped website content. While these sources could theoretically contain adversarial instructions, the skill's design—which uses dedicated scripts for data processing and requires manual human review of the generated CSV—effectively mitigates this risk.
Audit Metadata