The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions (in SKILL.md and references/api-setup.md) direct the agent to execute cat ~/.google-ads.yaml. This file is the primary storage for Google Ads API credentials, including the developer_token, client_id, client_secret, and refresh_token. Reading this file directly into the agent's prompt context creates a high risk of credential exposure.
[COMMAND_EXECUTION]: The skill uses several shell commands to manage the environment and verify configurations:
ls ~/.google-ads.yaml and ls google-ads.yaml are used to check for configuration files.
python -c "from google.ads.googleads.client import GoogleAdsClient; print('OK')" is used to verify the SDK installation.
[EXTERNAL_DOWNLOADS]: The documentation (references/api-setup.md) instructs users and agents to install external dependencies using pip install google-ads and pip install google-auth-oauthlib. These are well-known packages from a trusted service provider.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it processes untrusted data from external sources.
Ingestion points: The agent retrieves data from the Google Ads API (search responses) and performs browser snapshots (browser:snapshot) of live web pages at ads.google.com.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the workflows.
Capability inventory: The agent has capabilities for shell command execution (python, ls, cat) and browser control, which could be abused if malicious instructions are encountered in the data.
Sanitization: There are no provided instructions for sanitizing, validating, or escaping the data fetched from the API or the browser before it is processed by the agent.

google-ads