The Agent Skills Directory

[SAFE]: The skill provides implementation logic and documentation for integrating tracking with established ad platforms. All code provided is local and serves the primary function of the skill without hidden or suspicious behaviors.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by fetching landing pages and GTM container code (audit-playbook.md, SKILL.md). It mitigates risk through a non-negotiable instruction to the agent to treat all fetched content as data rather than instructions, and by providing a capability inventory that uses strict validation and escaping for user-supplied IDs (build_recipe.py).- [DATA_EXFILTRATION]: Tracking snippets are designed to send conversion signals to well-known, trusted domains (googleadservices.com, facebook.com, linkedin.com, etc.). The skill includes specific warnings and mitigation instructions for handling PII (phone numbers) and explicitly avoids reading sensitive data from cross-origin iframes where possible.- [DYNAMIC_EXECUTION]: Several JavaScript snippets intercept browser APIs (fetch, history) or use MutationObservers to detect conversions in modern web frameworks. This code is localized, well-commented, and purpose-specific, avoiding unsafe execution functions like eval or remote script loading.

conversion-tracking