OpenAI Codex security directory

OpenAI Ads Conversions

Published by OpenAI

High risk

Helps add OpenAI Ads conversion tracking to a code repository. Set up browser Measurement Pixel events and optional server-side Conversions API events. Validate coverage, event deduplication and attribution while keeping secrets out of client code.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Skill modifies application and configuration files: Can read, create, or change files on the local filesystem or in a selected project.
  • Instrumentation sends conversion and matching data to OpenAI Ads: Can send prompts, files, queries, or connected-service data to an external service.
  • Implementation inspects repository secrets/config and conversion data paths: Can read private account, workspace, repository, message, analytics, or file data.
  • Generated CAPI client relies on a durable secret: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
  • Skill edits executable application code and runs repository verification: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.

Available capabilities

This add-on exposes 1 tools or capabilities.

  • openai-ads-conversions-setup

The interactive security report will load automatically.