The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file SKILL.md contains the command cat ~/.google-ads.yaml under the 'Setup Check' section. This file is the standard configuration location for the Google Ads SDK and contains sensitive information including the developer_token, client_secret, and refresh_token. Executing this command exposes these plaintext credentials to the agent's context.
[DATA_EXPOSURE]: The skill explicitly targets sensitive configuration paths (~/.google-ads.yaml and google-ads.yaml) which are known to store authentication secrets for the Google Ads API.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the following surface:
Ingestion points: The skill reads campaign names, keyword text, and performance data from the Google Ads UI via browser automation (references/browser-workflows.md) and the Google Ads API (references/api-setup.md).
Boundary markers: There are no instructions or delimiters provided to the agent to treat data retrieved from the Google Ads account as untrusted or to ignore embedded instructions within ad copy or campaign names.
Capability inventory: The skill has the ability to pause campaigns, pause keywords, and modify budgets via both API mutations and browser automation actions.
Sanitization: There is no evidence of sanitization or validation of the strings retrieved from the Google Ads environment before they are processed or used in decision-making.

google-ads