ads-resonance
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a structured workflow for ad analysis that prioritizes data integrity and security. It includes specific instructions in
references/performance-data-sources.mdto avoid exposing OAuth credentials in diagnostic output and to validate SQL as read-only before execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes advertising data from external sources, presenting a standard ingestion surface.
- Ingestion points: Performance data is ingested from Google Ads MCP, BigQuery, and CSV files as defined in
references/performance-data-sources.md. - Boundary markers:
SKILL.mdandreferences/task-method.mdrequire scoping all records to verified workspace and customer IDs, and matching creative content using unique fingerprints rather than simple headlines. - Capability inventory: The skill writes performance reports to
~/Desktop/and maintains prediction records in~/.octave/predictions/. - Sanitization: The
references/resonance-report-template.mdenforces the generation of self-contained HTML reports without external JavaScript or assets (except for trusted Google Fonts), mitigating risks from malicious data in ad creative fields. - [COMMAND_EXECUTION]: The skill includes a local utility script,
scripts/predictions.py, for evaluating performance data. The script is deterministic, uses standard Python libraries for hashing and JSON processing, and does not exhibit dangerous behaviors such as dynamic code evaluation or unauthorized network access.
Audit Metadata