google-ads-negatives
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted search term data originating from external users on the internet.
- Ingestion points: Data is pulled from the Google Ads API via MCP using the
search_term_viewtable, which contains user-generated search queries. - Boundary markers: The instructions do not define boundary markers (e.g., delimiters) or specific "ignore embedded instructions" warnings for the search term data.
- Capability inventory: The skill has permissions to write to the file system (
workspace/ads/directory) and execute a local shell script. - Sanitization: There is no mention of sanitization or filtering logic to prevent the LLM from following instructions embedded within a search term query.
- [COMMAND_EXECUTION]: The skill requires the execution of a shell script to verify negative keyword inventory.
- Evidence: The instructions explicitly state to "Use the shared verification path in data/negative-inventory.md / scripts/negative-inventory.sh to check" account settings. This involves the agent executing a script distributed as part of the skill package.
Audit Metadata