google-ads-video-ops
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Google Ads API, including campaign names and resource metadata. This creates a surface for indirect instructions to be processed by the agent. The skill includes robust safeguards to mitigate this risk, such as establishing clear evidence boundaries, requiring explicit authorization before any mutation, and instructing the agent to resolve specific client accounts rather than inferring scope.
- [EXTERNAL_DOWNLOADS]: The documentation includes links to official Google Ads support pages and developer guides for CPV bidding, demographic targeting, and GAQL query structures. These references target a well-known service provider and are used appropriately for diagnostic and decision-making purposes.
- [COMMAND_EXECUTION]: The skill permits the application of authorized changes to Google Ads campaigns, such as adjusting budgets or target CPVs. To ensure safety, it mandates checking for shared-object usage (to avoid affecting unintended campaigns), reconciling current values immediately before writing, and performing independent read queries to verify that changes were persisted correctly.
- [CREDENTIALS_UNSAFE]: The skill demonstrates best practices for credential handling by explicitly prohibiting the request or printing of OAuth secrets. It further instructs that all sensitive information, including account identifiers and raw API responses, must be restricted to the user's private workspace and excluded from public repositories.
Audit Metadata