skills/octavehq/lfgtm/ads-resonance/Gen Agent Trust Hub

ads-resonance

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements a structured workflow for ad analysis that prioritizes data integrity and security. It includes specific instructions in references/performance-data-sources.md to avoid exposing OAuth credentials in diagnostic output and to validate SQL as read-only before execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes advertising data from external sources, presenting a standard ingestion surface.
  • Ingestion points: Performance data is ingested from Google Ads MCP, BigQuery, and CSV files as defined in references/performance-data-sources.md.
  • Boundary markers: SKILL.md and references/task-method.md require scoping all records to verified workspace and customer IDs, and matching creative content using unique fingerprints rather than simple headlines.
  • Capability inventory: The skill writes performance reports to ~/Desktop/ and maintains prediction records in ~/.octave/predictions/.
  • Sanitization: The references/resonance-report-template.md enforces the generation of self-contained HTML reports without external JavaScript or assets (except for trusted Google Fonts), mitigating risks from malicious data in ad creative fields.
  • [COMMAND_EXECUTION]: The skill includes a local utility script, scripts/predictions.py, for evaluating performance data. The script is deterministic, uses standard Python libraries for hashing and JSON processing, and does not exhibit dangerous behaviors such as dynamic code evaluation or unauthorized network access.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:24 PM