pp-openai-ads
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
openai-ads-pp-cliandopenai-ads-pp-mcptools from the vendor's official GitHub repositories and NPM organization (github.com/mvanhorn,@mvanhorn) using standard Go and Node.js installation methods. - [COMMAND_EXECUTION]: Relies on the execution of the
openai-ads-pp-clibinary via the shell to perform ad account management, pacing audits, and structural analysis. - [DYNAMIC_EXECUTION]: Features a 'playbook' system where shell commands are dynamically constructed at runtime by substituting query entities into command templates (
{slot}) stored in a local SQLite database. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a significant vulnerability surface by ingesting untrusted natural language user input via the
recall,teach, andplaybook amendcommands to influence automated tool operations. - Ingestion points: User-supplied questions and natural language queries are processed by the CLI to retrieve or create automated playbooks.
- Boundary markers: The skill provides a multi-step 'confirm/reject' workflow for new candidate learnings and explicitly instructs the agent to strip PII from queries before teaching them.
- Capability inventory: The skill possesses the capability to execute shell commands, perform file system writes (SQLite DB, configuration files), and execute network requests via the underlying advertiser API.
- Sanitization: Implements a learning loop that requires explicit verification of command behavior before confirmation, though it relies on user/agent judgment to prevent malicious instruction ingestion.
Audit Metadata