Claude Code, Skill
Google Ads Api Agent
Google Ads Api Agent, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ae561508640c, unchanged since the check below.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
actions/main-agent/18_cloudinary_creative_tools.py, line 45
response = requests.post(f"https://api.cloudinary.com/v1_1/{creds['cloud_name']}/{resource_type}/upload", data=params, timeout=120)
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
actions/main-agent/01_label_manager.py, line 2
subprocess.check_call(["pip", "install", "google-ads>=28.1.0"])
actions/main-agent/02_conversion_tracking_manager.py, line 2
subprocess.check_call(["pip", "install", "google-ads>=28.1.0"])
actions/main-agent/03_audience_manager.py, line 7
subprocess.check_call(["pip", "install", "google-ads"])
Show more
actions/main-agent/04_asset_manager.py, line 7
subprocess.check_call(["pip", "install", "google-ads"])
actions/main-agent/05_budget_manager.py, line 7
subprocess.check_call(["pip", "install", "google-ads"])
actions/main-agent/06_rsa_ad_manager.py, line 7
subprocess.check_call(["pip", "install", "google-ads"])
actions/main-agent/07_bid_keyword_manager.py, line 7
subprocess.check_call(["pip", "install", "google-ads"])
actions/main-agent/08_negative_keywords_manager.py, line 7
subprocess.check_call(["pip", "install", "google-ads"])
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 6
anthropic>=0.43.0
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
actions/main-agent/18_cloudinary_creative_tools.py, line 45
response = requests.post(f"https://api.cloudinary.com/v1_1/{creds['cloud_name']}/{resource_type}/upload", data=params, timeout=120)
actions/sub-agents/creative-innovate/01_cloudinary_tools.py, line 243
response = requests.post(upload_url, data=data, timeout=120)
actions/sub-agents/creative-innovate/01_cloudinary_tools.py, line 299
response = requests.get(url, timeout=60)
Show more
actions/sub-agents/creative-innovate/01_cloudinary_tools.py, line 385
response = requests.get(url, timeout=60)
actions/sub-agents/creative-innovate/02_gemini_vision.py, line 97
resp = requests.get(url, timeout=60)
actions/sub-agents/creative-innovate/02_gemini_vision.py, line 391
video_response = requests.get(video_fetch_url, timeout=120)
actions/sub-agents/research/02_google_search_api.py, line 53
response = requests.get(
actions/sub-agents/research/03_ads_transparency_center.py, line 69
response = requests.get(
actions/sub-agents/research/04_google_trends_analyzer.py, line 109
response = requests.get(
CHANGELOG.md, line 35
- Real-time WebSocket (Agents SDK)
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
actions/sub-agents/creative-innovate/02_gemini_vision.py, line 85
return os.environ.get('GEMINI_API_KEY') or os.environ.get('GOOGLE_API_KEY')
deploy/orchestrator.py, line 64
self.client = anthropic.Anthropic(api_key=api_key or os.environ.get("ANTHROPIC_API_KEY"))
deploy/orchestrator.py, line 207
self.client = anthropic.Anthropic(api_key=api_key or os.environ.get("ANTHROPIC_API_KEY"))
Show more
deploy/server.py, line 195
"anthropic_key_set": bool(os.environ.get("ANTHROPIC_API_KEY")),
deploy/server.py, line 196
"google_ads_configured": bool(os.environ.get("GOOGLE_ADS_DEVELOPER_TOKEN")),
scripts/cli.py, line 39
if not os.environ.get("ANTHROPIC_API_KEY"):
scripts/cli.py, line 42
print(" → Add it to your .env file or export it")
scripts/validate.py, line 137
api_key = os.environ.get("ANTHROPIC_API_KEY")
.env.example, line 4
# Copy to .env and fill in your values: cp .env.example .env
.env.example, line 5
# NEVER commit .env to git.
.gitignore, line 1
# Environment & secrets
.gitignore, line 2
.env
.gitignore, line 4
!.env.example
CHANGELOG.md, line 54
- `.env.example` - Environment variable template with placeholders
CONTRIBUTING.md, line 27
cp .env.example .env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ae561508640c. requests shell access. The manifest names this permission. dependencies are not pinned. accepts a host from input, with no fixed list in this file. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: ae561508640ccbe400f2e1c9f3a17c82fd45dd8b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.