The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses the sensitive local environment file .env.local to retrieve API authentication tokens like META_ACCESS_TOKEN and META_AD_ACCOUNT_ID using shell commands.
[DATA_EXFILTRATION]: Extracted credentials and advertising performance data are transmitted to Meta's official Graph API (graph.facebook.com) for campaign management, evaluation, and production tasks.
[COMMAND_EXECUTION]: The skill executes shell utilities, including grep and cut, to parse local configuration files and curl to perform network operations.
[REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes logic from a local Python script at kai/paid_media/creative_formats.py to select advertising formats and hook types.
[PROMPT_INJECTION]: The skill performs automated project discovery by ingesting project metadata and source code to generate marketing context, which creates a surface for indirect prompt injection.
Ingestion points: Reads CLAUDE.md, README.md, package.json, and other codebase files to generate a MARKETING.md file.
Boundary markers: No explicit delimiters or instructions are specified to differentiate ingested project content from the agent's core instructions.
Capability inventory: The skill possesses capabilities for network access (curl), file modification (workspace/ads/), and shell command execution (grep).
Sanitization: No explicit validation or sanitization of the discovered project metadata is described before it is used to influence the ad generation process.

kai-ad-campaign