google-ads-landing
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a diagnostic tool for advertising landing pages, following its described purpose without any malicious behavior.
- [EXTERNAL_DOWNLOADS]: Fetches content from external landing pages and the Google PageSpeed Insights API. These network operations are legitimate requirements for analyzing page speed and on-page copy.
- [COMMAND_EXECUTION]: Employs the
runScripttool to perform GAQL queries against the Google Ads API, which is necessary to gather campaign context for the landing page audit. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing external website content. 1. Ingestion points: Raw HTML content fetched via WebFetch in SKILL.md Phase 2. 2. Boundary markers: No explicit delimiters or instructions are used to separate external content from the agent's instructions. 3. Capability inventory: runScript for Google Ads queries, WebFetch for network access, and local file writing for history. 4. Sanitization: No sanitization of the fetched HTML content is mentioned. This risk is inherent to the skill's primary function of web analysis.
Audit Metadata