google-ads-mcp-setup-guide
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/mcp_smoke_test.py) that utilizessubprocess.Popento launch the Google Ads MCP server locally. This is the primary intended function of the script, designed to verify the MCP handshake and tool discovery via standard I/O without opening network listeners or executing arbitrary remote commands. - [EXTERNAL_DOWNLOADS]: The documentation and tutorial files guide the user to install official software from trusted sources, including the
google-ads-mcppackage from PyPI and official agent skills from thegoogle/skillsrepository. It also references a diagnostic tool kit hosted in the skill author's own GitHub repository (futurizerush/google-ads-agent-kit). - [INDIRECT_PROMPT_INJECTION]: As a tool designed to query the Google Ads API, the skill naturally processes external data (e.g., campaign names and account lists). The verification script mitigates potential injection risks by implementing strict JSON schema validation, regex-based account ID filtering, and a robust error classification system that prevents raw API errors or potentially malicious payloads from being passed directly to the AI host.
Audit Metadata