Openclaw Google Ads

Shared Google Ads API skill for OpenClaw agents. Query account, campaign, ad group, keyword, search term, and performance data with local scripts and GAQL ex...

This skill appears to be a legitimate Google Ads reporting/audit utility, but exercise caution before installing or running it: - The registry metadata does NOT declare the environment variables the scripts actually require. Expect to need at least: GOOGLE_ADS_DEVELOPER_TOKEN, GOOGLE_ADS_CLIENT_ID, GOOGLE_ADS_CLIENT_SECRET, GOOGLE_ADS_REFRESH_TOKEN, and optionally manager/client account IDs. Treat these as sensitive and provide them via your secure runtime secret injection, not by pasting into files. - The authenticate.py script prints the refresh token to stdout so you can copy it into secure storage. Do not run that in a context where console output is captured or sent to chat/logs you don't control. Prefer running it in a secure terminal and immediately storing the token in your vault. - Review the code (it's short and included) and confirm you trust the unknown publisher and the environment where you will run it; the repo has no homepage/source contact. Verify your logging and agent capture settings to ensure tokens and PII are not accidentally forwarded. - Install dependencies (requirements.txt) in an isolated environment if you decide to run anything. Consider running read-only scripts first (get_account_summary, gaql_query) and require explicit human approval before making any live changes. If you want higher assurance, ask the publisher to update the registry metadata to list the required env vars and to change authenticate.py to avoid printing secrets directly (for example, prompt to store the token into a secure credential store instead).

Type: OpenClaw Skill Name: openclaw-google-ads Version: 0.2.0 The skill bundle provides a legitimate and well-structured interface for interacting with the Google Ads API, focusing on reporting, auditing, and performance analysis. The Python scripts (e.g., authenticate.py, gaql_query.py) follow standard Google Ads API implementation patterns, and the SKILL.md instructions explicitly enforce safety protocols, such as a 'read-only' default stance and requiring explicit approval for account changes. No evidence of data exfiltration, malicious execution, or prompt injection was found.