google-ads-audit
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources, creating a vulnerability to indirect prompt injection attacks.\n
- Ingestion points: Data is retrieved via the
WebSearchtool (policy changes), theWebFetchtool (business homepage, about page, and ad landing pages), and search term data from the Google Ads API (search_term_view).\n - Boundary markers: The instructions lack specific delimiters or guardrails (e.g., 'ignore embedded instructions') to isolate untrusted content from the system prompt, which could allow malicious instructions in websites or search terms to influence the agent.\n
- Capability inventory: The skill can execute generated scripts through
runScript, perform network operations viaWebFetchandWebSearch, and write persistent files to the local file system (business-context.json,personas/{accountId}.json).\n - Sanitization: No logic is specified for sanitizing or filtering the content retrieved from external URLs or search results before it is processed by the model.\n- [DYNAMIC_EXECUTION]: The skill uses the
runScripttool to dynamically generate and execute GAQL (Google Ads Query Language) scripts.\n - Mechanism: The agent constructs GAQL queries at runtime to aggregate account performance data, extending a baseline platform resource (
notfair://playbooks/audit-account).\n - Risk: While a core functional feature, the dynamic assembly of executable queries based on model-generated logic represents a potential vector for injection if combined with untrusted inputs.
Audit Metadata