Google Ads Intent MCP

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing from a moving GitHub source means the code a user receives may differ from what was reviewed here.

Why it was flagged

The setup flow installs executable code from a remote GitHub repository, and the provided review artifacts do not include that code or pin it to a specific release or commit.

Skill content
`pipx install "git+https://github.com/davidmosiah/google-ads-intent-mcp.git"`
Recommendation

Review the repository, prefer a tagged release or pinned commit if available, and run setup only when the user has explicitly requested installation.

What this means

If the related MCP tool is configured for live Google Ads access, credentials could expose or affect advertising account data depending on their scope.

Why it was flagged

The skill acknowledges that sensitive Google Ads or provider credentials may be present. The guidance is protective, but credentials remain high-impact access if live account functionality is used.

Skill content
"Do not print OAuth tokens, API keys, service-account JSON, local token files, or private user data."
Recommendation

Use least-privilege credentials, avoid sharing token files in chat, and require explicit confirmation before any live provider call or account-changing action.