pp-openai-ads

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the openai-ads-pp-cli and openai-ads-pp-mcp tools from the vendor's official GitHub repositories and NPM organization (github.com/mvanhorn, @mvanhorn) using standard Go and Node.js installation methods.
  • [COMMAND_EXECUTION]: Relies on the execution of the openai-ads-pp-cli binary via the shell to perform ad account management, pacing audits, and structural analysis.
  • [DYNAMIC_EXECUTION]: Features a 'playbook' system where shell commands are dynamically constructed at runtime by substituting query entities into command templates ({slot}) stored in a local SQLite database.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes a significant vulnerability surface by ingesting untrusted natural language user input via the recall, teach, and playbook amend commands to influence automated tool operations.
  • Ingestion points: User-supplied questions and natural language queries are processed by the CLI to retrieve or create automated playbooks.
  • Boundary markers: The skill provides a multi-step 'confirm/reject' workflow for new candidate learnings and explicitly instructs the agent to strip PII from queries before teaching them.
  • Capability inventory: The skill possesses the capability to execute shell commands, perform file system writes (SQLite DB, configuration files), and execute network requests via the underlying advertiser API.
  • Sanitization: Implements a learning loop that requires explicit verification of command behavior before confirmation, though it relies on user/agent judgment to prevent malicious instruction ingestion.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 10:13 AM
Security Audit — agent-trust-hub — pp-openai-ads