The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing third-party tools from unverifiable external sources, including GitHub repositories like github.com/jamiepine/voicebox and github.com/gooseworks-ai/gooseworks-ads-skills.
[COMMAND_EXECUTION]: The documentation encourages the execution of shell commands to set up external tools from unknown sources, such as git clone https://github.com/jamiepine/voicebox.git, npx gooseworks install --all, and make setup. These commands execute code from repositories outside the agent's trusted environment.
[REMOTE_CODE_EXECUTION]: The skill outlines a production route for video ads that involves installing the gooseworks package via npx and running custom code-based pipelines involving Playwright and ffmpeg. Additionally, the skill generates a self-contained HTML file (review.html) by populating a JSON data block within a template. While the template includes an esc() function to prevent XSS and instructions for escaping characters, the runtime generation of executable HTML content from AI-generated data is a dynamic execution pattern.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted external data, specifically customer reviews from inputs/reviews/ and ad comments from inputs/comments/. Maliciously crafted input in these files could influence agent behavior during copy generation.
Ingestion points: The skill reads external files from inputs/reviews/ and inputs/comments/ as part of its 'Grounded Inputs' workflow.
Boundary markers: Instructions advise grounding every concept in source material but do not include explicit delimiters or instructions to ignore commands within the ingested text.
Capability inventory: The agent has the ability to write files (HTML generation), execute shell commands for ad platforms, and suggests running installation scripts for third-party tools.
Sanitization: The assets/creative-review-template.html file includes an esc() function for HTML escaping values rendered to the DOM.

ad-creative