query-to-keyword-promoter
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and does not contain any executable code, shell scripts, or external dependencies.
- [SAFE]: The instructions explicitly mandate a 'READ-ONLY' approach and include multiple guardrails to ensure that no changes are executed automatically.
- [DATA_EXPOSURE]: While the skill interacts with Google Ads data via the Model Context Protocol (MCP), it correctly identifies its scope as 'read-only' in both the prompt instructions and the metadata configuration. No evidence of credential harvesting or data exfiltration to unauthorized domains was found.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external search term data and account configuration. Although it does not use explicit boundary markers (like XML tags) for this data, the lack of any 'write' or 'execute' capabilities in the skill's instructions mitigates the risk of indirect prompt injection leading to harmful actions.
Audit Metadata