The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/update-skill.sh contains a self-update mechanism that downloads and replaces executable bash scripts from the author's GitHub repository (github.com/fdarkaou/genviral-skill). Documentation in docs/setup.md explicitly instructs the user to configure system-level cron jobs to periodically run this update script, which allows for persistent remote modification of the skill's executable logic.
[COMMAND_EXECUTION]: Multiple Python scripts, such as meta-ads/campaign/scripts/orchestrate.py and meta-ads/campaign/scripts/generate_creatives.py, utilize the subprocess.run function to execute external shell commands, including downloads via curl and the execution of the sibling bash script genviral.sh.
[PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.
Ingestion points: meta-ads/campaign/scripts/lp_analyzer.py scrapes landing page content from user-provided URLs, and meta-ads/campaign/scripts/ad_library.py pulls ad data from Meta's Ad Library.
Boundary markers: Analysis shows no evidence of delimiters or 'ignore embedded instructions' warnings when this data is processed.
Capability inventory: The skill maintains capabilities for shell command execution (subprocess.run), network requests (api_call), and file system writes across its automation scripts.
Sanitization: There is no evidence of filtering or sanitization of external content before it is interpolated into LLM prompts in meta-ads/scripts/copy_generator.py and meta-ads/campaign/scripts/generate_creatives.py.
[EXTERNAL_DOWNLOADS]: The skill performs numerous outbound network requests using curl and Python's urllib.request. These requests target the Genviral Partner API, Meta Graph API, Anthropic Messages API, and GitHub's raw content servers for updates.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive credentials, including the Genviral API key, Meta Ads system user tokens, and Anthropic API keys. While environment variables are supported, the skill also utilizes a local config.yaml file for Meta credentials and attempts to read global agent keys from ~/.openclaw/openclaw.json. Additionally, meta-ads/campaign/scripts/ad_library.py contains a hardcoded placeholder credential string APPID|APPSECRET.

genviral