Token导航 LogoToken导航

Agent Skill · 研究检索

ads-audit(广告审核)

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

ads-audit 是研究检索类 Agent Skill,可用宿主为 Codex、Claude、Cursor、Gemini CLI,通过GitHub 仓库获取,权限为接触敏感数据;许可证信息还不明确,第三方扫描有提醒项,按安装量在研究检索类的 73,675 个 Skill 里排第 54,512。

总安装 509周安装 21GitHub Stars 1,517下载 166核验 2026-05-01

安装说明

本站只整理中文说明,不托管安装包,也不代用户安装。
GitHub
许可证
unknown

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:ads-audit(广告审核)
来源仓库:https://github.com/nowork-studio/toprank
仓库路径:skills/ads-audit
安装命令:
npx skills add https://github.com/nowork-studio/toprank --skill ads-audit
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/nowork-studio/toprank --skill ads-audit

这个 Skill 是做什么的

研究检索类 Skill 主要解决「找资料、核对事实、把来源整理清楚」的问题,通常会让助手先检索再总结。

用于安全审计和权限检查。ads-audit 属于研究检索类 Skill,可作为该场景下的辅助能力补充。适合分析凭据风险和认证流程。适用宿主包括 Codex、Claude、Cursor、Gemini CLI,接入前应确认版本、权限和运行环境要求。不能将工具输出直接当作最终结论。涉及密钥或用户数据时应确认最小权限。

建议在测试环境中先行验证,避免影响生产系统。

来源仓库内路径:skills/ads-audit

上手步骤

4 步
  1. 1

    确认自己的宿主工具

    公开资料标注支持 Codex、Claude、Cursor、Gemini CLI;先确认自己用的是其中之一,再按对应工具的 Skills 目录放置。

  2. 2

    拿到安装命令

    可以直接复制的命令是 npx skills add https://github.com/nowork-studio/toprank --skill ads-audit;命令里的占位符换成自己的路径或密钥再执行。

  3. 3

    安装后重启宿主

    命令执行完要完全退出宿主工具再打开,让新装的 Skill 被重新扫描到,否则列表里可能看不到。

  4. 4

    按最小权限试用

    它需要接触敏感数据,先在测试目录或测试账号里跑,确认没问题再放到正式项目。

常见问题

6 条

ads-audit 怎么安装?

在终端执行 npx skills add https://github.com/nowork-studio/toprank --skill ads-audit。装完完全退出宿主工具再打开,让它重新扫描本地 Skill。

ads-audit 支持哪些 AI 工具?

公开资料标注支持 Codex、Claude、Cursor、Gemini CLI。其他工具只要能读取本地 Skill 目录,一般也能手动放进去,但要自己确认触发方式是否一致。

ads-audit 需要什么权限?

权限级别是接触敏感数据。该 Skill 可能接触密钥、Token、环境变量或敏感配置,应进入高风险复核队列,默认不自动发布。

ads-audit 是免费的吗?

公开资料没有标注明确许可证,收费和商用限制都无法确认。正式使用前请到来源仓库核对授权说明。

ads-audit 用的人多吗?

公开数据是累计安装 509 次,近一周安装 21 次,下载 166 次,GitHub 1,517 星。这些数字来自第三方目录统计,只能当作热度参考,不代表质量或安全性。

ads-audit 安全吗?

第三方扫描有提醒项,说明存在需要人工确认的行为。安装前请打开源码看清它读了什么、联网到哪里。

值得选的地方和要先想清楚的地方

值得选的地方

  • 同时适配 4 种工具,换客户端不用重新找替代品。
  • 来源仓库有 1,517 星,维护活跃度相对可查。

先想清楚的地方

  • 需要接触敏感数据,装到常用环境前要先评估影响面。
  • 许可证没有明确标注,能不能商用、能不能再分发都不确定。
  • 第三方扫描存在提醒项或未通过项,需要人工逐条确认。
  • 第三方目录整理,版本更新和行为细节以来源仓库为准。

适不适合你

更适合

  • 已经在用 Codex,想直接扩展它能力的人。
  • 需要处理研究检索类任务、又不想每次都手写提示词的人。

不太适合

  • 环境里有大量密钥、凭证,不方便给第三方 Skill 读取的人。
  • 需要明确授权才能用到公司项目里的场景。
  • 需要厂商级技术支持和 SLA 的生产系统。

研究检索类 Skill 对比

6 个同类
Skill总安装GitHub 星权限许可证扫描
find-skills

寻找技能 · Codex、Claude

31,199,81316,486操作浏览器MIT有提醒
self-improving-agent

自我改进 Agent · OpenClaw

16,464,0023,396接触敏感数据MIT-0通过
soultrace

灵魂追踪 · Codex、Claude

7,588,94412需要联网未明确有提醒
self-improving

自我完善 · OpenClaw

6,829,2841,046需要联网MIT-0通过
microsoft-foundry

微软代工厂 · Codex、Claude

6,614,144764调用外部服务未明确有提醒
ads-audit

广告审核 · 本页

5091,517接触敏感数据未明确有提醒

按安装量取同分类前几名;数字来自第三方目录统计,只作热度参考,不代表质量结论。

SKILL.md 原文

Google Ads Audit

Diagnose account health and persist business context for downstream skills (/ads, /ads-copy, /ads-landing). Read-only — never mutates the account. The user runs /ads to execute fixes you recommend.

Setup

Follow ../shared/preamble.md — MCP detection, API key, account selection.

Filesystem contract (MUST persist)

ArtifactPathWhen
Business context{data_dir}/business-context.jsonFirst full audit, or refresh when audit_date is >90 days old. Skip on scoped audits if file is fresh.
Personas{data_dir}/personas/{accountId}.jsonEvery full audit.

These are the handoff to every other ads skill — write them even if the report itself is short. Otherwise /ads-copy and /ads-landing operate without business context and produce generic output.

business-context.json schema: business_name, industry, website, services[], locations[], target_audience, brand_voice{tone, words_to_use[], words_to_avoid[]}, differentiators[], competitors[], seasonality{peak_months[], slow_months[], seasonal_hooks[]}, keyword_landscape{high_intent_terms[], competitive_terms[], long_tail_opportunities[]}, social_proof[], offers_or_promotions[], landing_pages{}, notes, audit_date, account_id.

personas JSON schema: {account_id, saved_at, personas: [{name, demographics, primary_goal, pain_points[], search_terms[], decision_trigger, value}]}. See references/persona-discovery.md.

Policy freshness check (run first)

Read ../shared/policy-registry.json. For each entry where last_verified + stale_after_days < today:

  • High-volatility → WebSearch the area for recent Google Ads changes; compare to assumption. If drift, banner the report and suggest registry update.
  • Moderate-volatility → one-line "may warrant a check" note.
  • Stable → skip silently.

Phase 1 — Pull the audit dataset

Use a single runScript call with ads.gaqlParallel to fan out the queries an audit needs. The server's adsagent://playbooks/audit-account resource has a battle-tested baseline; extend it with what this rubric needs that isn't already there.

A complete audit needs at minimum:

  • Account / customer-level metrics (customer resource) — totalSpend, conversions, conv-value, clicks, impressions for the audit window.
  • Campaign-level performance (campaign) — id, name, status, advertising_channel_type, bidding_strategy_type, network settings, search/top/abs-top impression share, budget-lost-IS, rank-lost-IS, status-rich metrics. Cap window at 90 days (impression-share data limit).
  • Ad-group performance (ad_group) — to attach top-line metrics under each campaign.
  • Keyword performance with QS (keyword_view) — text, match type, status, quality score (and components if needed), cost, clicks, conversions. Surfaces zombie keywords (0 impressions 30d), low-QS-with-spend, zero-converters.
  • Search terms (search_term_view) — for waste detection (clicks > 10, conv = 0) and brand-leakage detection (brand terms triggered by non-brand campaigns).
  • Negative keywords (campaign_criterion where type='KEYWORD' and negative=TRUE) — for negative-conflict detection and coverage.
  • Conversion actions (conversion_action) — count, status, primary-vs-secondary, counting type. STOP-condition input.
  • Ad assets (ad_group_ad) — RSA headlines/descriptions for asset-coverage scoring and topAds extraction.
  • Geo targeting (campaign_criterion where type IN ('LOCATION','PROXIMITY')) — for multi-location structure scoring. radius_units: 0=meters, 1=km, 2=miles.
  • Recent change events (change_event, max 30 days) — to flag recent edits that might explain regressions.

Compute aggregates in the script, return summarized JSON. Don't return all rows — rank, slice, summarize. The agent narrates the result, the script does the math.

getRecommendations is a useful cross-check for Google's own recommendation surface — call it as a separate tool after the runScript pass if you want to compare your findings to Google's.

If a critical query errors out (auth, schema), surface the error and stop — don't fall back to a degraded audit.

Skip scoring entirely if totalSpend == 0 or activeCampaigns == 0. Go straight to business context.

Phase 2 — Scope handling

If the user narrows the audit ("focus on grooming", "campaign X", "just check waste"):

  • Match campaign names by case-insensitive substring. If no match, list available campaigns and ask.
  • Filter the in-memory dataset before scoring — no extra API calls.
  • Account-level dimensions (conversion tracking) stay account-wide. Note "Scoped to: X" in the report.
  • Skip Phase 4 (business context refresh) on scoped audits if business-context.json is fresh.

Phase 3 — Score

Score each of the 7 dimensions 0–5 using references/account-health-scoring.md. Overall = round(sum × 100 / 35).

ScoreLabelMeaning
0CriticalBroken or missing — actively losing money
1PoorMajor waste or missed opportunity
2Needs WorkSeveral clear issues
3AcceptableFunctional, room to improve
4GoodWell-managed, minor opportunities
5ExcellentBest-practice

Scope-aware: campaign-level dimensions reflect in-scope data; account-level dimensions (conversion tracking) score account-wide with a note on scope impact.

Encoded heuristics — apply these, they aren't obvious

  • Weighted QS by spend, not by keyword count. A QS-3 keyword burning $2,000/mo matters infinitely more than ten QS-3 keywords burning $5/mo combined.
  • Brand-leakage premium. When brand campaigns are paused or starved, brand traffic leaks to non-brand at 5–10× higher CPA. Always check whether brand terms appear in non-brand campaigns' search-term reports.
  • Waste formula. Keyword waste = clicks > 10 AND conversions = 0 AND cost > 0. Search-term waste = same, applied to actual queries. Sum them — that's the recoverable spend.
  • Display + Search mixed in one campaign is structurally broken — Display dilutes Search metrics and burns budget on unintended placements. Flag any campaign where network_settings.target_content_network = TRUE for a SEARCH channel campaign.
  • Zombie keywords (0 impressions for 30+ days) clutter reporting and confuse Google's ML — recommend pause.
  • Counting type matters. Lead-gen should use ONE per click; e-commerce should use EVERY. Wrong setting silently inflates or deflates conversions.
  • STOP condition. If conversion tracking scores 0–1, recommend pausing spend until tracking is fixed. Everything downstream of measurement is unreliable.

Impression Share Interpretation Matrix

Rank-Lost < 30%Rank-Lost 30–50%Rank-Lost > 50%
Budget-Lost < 20%HealthyQS / bid problemQuality crisis
Budget-Lost 20–40%Budget problemMixed (fix quality first)Structural — too-competitive keywords
Budget-Lost > 40%Severe budget gap (highest-ROI fix if CPA is good)Fix rank first, then add budgetFundamental misalignment — pause and restructure

Phase 4 — Business context

Derive what you can from the data already pulled:

FieldSource
business_nameAccount name (from customer.descriptive_name)
servicesCampaign + ad-group names, top converting keywords
locationscampaign_criterion LOCATION + PROXIMITY
brand_voiceTop-performing RSA headlines / descriptions
keyword_landscape.high_intent_termsConverting keywords with strong CVR
keyword_landscape.competitive_termsKeywords in campaigns with high rank-lost-IS
keyword_landscape.long_tail_opportunitiesConverting search terms not yet promoted to keywords
websiteApex domain from ad final URLs

Then crawl the website (homepage + about + services + top 3 ad landing pages, parallel WebFetch) and merge into the schema. See references/business-context.md for the full crawl procedure.

Always ask the user (it's faster than guessing): differentiators, competitors, seasonality. Ask for everything else only if the data + crawl can't answer it.

Phase 5 — Personas

Discover 2–3 personas from search terms, top keywords, ad-group themes, landing pages, geo, and device split — all from the dataset already in memory. Persist to {data_dir}/personas/{accountId}.json. Each persona must be grounded in 5+ actual search terms; if not, drop it. See references/persona-discovery.md.

Phase 6 — Report

Lead with the verdict, then the top 3 actions (with dollar impact when possible), then the scorecard, then evidence for dimensions scoring 0–2 only. Cite specific campaigns, keywords, and dollar amounts. Cap at ~80 lines.

End with a single closing line after the handoff to /ads:

*Your audit history is saved to your AdsAgent account — view it at https://adsagent.org.*

Guardrails

  1. Read-only skill. Diagnose; don't mutate. Every fix routes through /ads (or /ads-copy, /ads-landing). End the report with one handoff tied to the #1 action.
  2. STOP condition — if conversion tracking scores 0–1, recommend pausing spend until it's fixed before recommending anything else. Everything downstream is meaningless without measurement.
  3. Always persist business-context.json and personas/{accountId}.json even if the report itself is short — downstream skills depend on them.
  4. Name names. Every finding cites specific campaigns, keywords, search terms, and dollar amounts. "Some keywords are underperforming" is not a finding.

平台分布

Codex

33.28%
按下载量换算55

Claude

32.19%
按下载量换算53

Cursor

17.87%
按下载量换算30

Gemini CLI

8.99%
按下载量换算15

安全审计

Gen Agent Trust Hub

通过

Socket

可疑

Snyk

可疑

权限和风险

接触敏感数据

该 Skill 可能接触密钥、Token、环境变量或敏感配置,应进入高风险复核队列,默认不自动发布。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。来源安全扫描存在提醒或未通过项,安装前请自行复核。目前只有一个公开来源,建议同时核对源仓库。

继续浏览同类 Skills