google-ads-apply
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external draft markdown files which represent an attack surface for indirect prompt injection.
- Ingestion points: The
applyandreviewcommands read user-provided draft files ([draft-file]) found inSKILL.md. - Boundary markers: The system uses specific markdown headers (e.g.,
## Apply Manifest,Section A: Negatives to ADD) to identify actionable content within the drafts. - Capability inventory: The skill can perform mutations in Google Ads, such as adding negative keywords, pausing entities, and updating budgets via scripts like
gads-apply.sh. - Sanitization: The skill implements validation steps including account ID verification, campaign/ad-group existence checks via GAQL, and scope enforcement before any execution.
- [COMMAND_EXECUTION]: The skill executes local shell scripts located in
scripts/apply-layer/to handle the business logic of parsing drafts, validating actions, and communicating with the Google Ads API. These scripts are invoked via commands like/google-ads applyand/google-ads undo.
Audit Metadata