The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to execute cat ~/.google-ads.yaml in the 'Setup Check' section of SKILL.md. This command reads the full contents of the Google Ads configuration file, which contains sensitive information including developer_token, client_id, client_secret, and refresh_token. Reading this file into the agent's context and output streams exposes these credentials to the conversation history and platform logs, significantly increasing the risk of credential theft.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted data from external sources (Google Ads UI and API).
Ingestion points: Data is pulled from the browser via browser:snapshot and from the API via ga_service.search() in SKILL.md and references/browser-workflows.md.
Boundary markers: The skill does not use delimiters or instructions to ignore embedded commands within the retrieved ad data (e.g., campaign names, keyword text).
Capability inventory: The skill has capabilities for shell command execution, browser automation, and Python script execution for mutating account states (e.g., pausing campaigns).
Sanitization: There is no evidence of validation or sanitization of the campaign names or keyword text before they are processed by the agent.

google-ads