youtube-placement-audit
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads its functional Python scripts and markdown documentation from the author's public GitHub repository using curl. It also requires several standard Python libraries (google-ads, gspread, google-auth, google-api-python-client, pyyaml) from the official Python Package Index (PyPI). These downloads are legitimate and necessary for the tool's PPC auditing functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes placement names and URLs retrieved from the Google Ads API. While this constitutes an ingestion of external data, the risk is minimal as the content is only used for keyword filtering and spreadsheet reporting. 1. Ingestion points: YouTube placement names and URLs fetched from the Google Ads API via the performance_max_placement_view and detail_placement_view resources. 2. Boundary markers: The skill does not use specific delimiters or protective instructions in its output to Google Sheets. 3. Capability inventory: The skill has the capability to write to Google Sheets, query the Google Ads API, and query the YouTube Data API. 4. Sanitization: The scripts perform case-insensitive keyword matching and Unicode script detection to flag content but do not otherwise sanitize the strings.
- [COMMAND_EXECUTION]: The skill provides Python scripts that perform network operations and file access to manage Google Ads data. These operations are restricted to relevant Google APIs and the local google-ads.yaml configuration file, consistent with the tool's administrative purpose.
Audit Metadata