The Agent Skills Directory

[DATA_EXFILTRATION]: The skill directs the agent to access and display sensitive credential files. Specifically, SKILL.md contains an instruction to run cat ~/.google-ads.yaml, a command that outputs the Google Ads developer token, client ID, client secret, and refresh token. By prompting the agent to reveal these secrets, the skill risks exposing them in the session history or logs. Furthermore, references/api-setup.md provides instructions for handling client_secret.json and generating OAuth refresh tokens, which are sensitive operations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources (Google Ads UI and API) that can be influenced by third parties.
Ingestion points: The agent is instructed to capture browser snapshots of ads.google.com and parse campaign/keyword tables, as well as query the GoogleAdsService API for performance metrics.
Boundary markers: No specific delimiters or instructions are provided to the agent to treat ad names, keyword text, or report data as untrusted content.
Capability inventory: The skill possesses significant capabilities, including the ability to pause campaigns, pause keywords, and modify budgets via the mutate services and browser automation.
Sanitization: There is no evidence of sanitization or validation logic to prevent the agent from executing instructions potentially embedded in campaign names, keyword strings, or other user-controlled ad account data.

google-ads