google-ads
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is an official connector produced by a known and trusted vendor (Zapier), designed to wrap the Google Ads REST API.
- [COMMAND_EXECUTION]: The
cli.jsentry point usesspawnSyncto execute the connector's own internal scripts (cli.tsordist/cli.js). This is a standard architectural pattern for providing a consistent CLI across different environment configurations and does not facilitate arbitrary command injection. - [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with
googleads.googleapis.com, which is the official, well-known domain for Google Ads services. These network operations are necessary for the skill's primary functionality. - [CREDENTIALS_UNSAFE]: No hardcoded secrets, API keys, or tokens were detected. The skill correctly implements credential management by reading OAuth access tokens and developer tokens from environment variables or via a managed authentication resolver.
- [PROMPT_INJECTION]: The instructions in
SKILL.mdand the scripts are strictly focused on operational guidance for the agent and do not contain any patterns attempting to bypass safety filters or override system instructions.
Audit Metadata