The Agent Skills Directory

[DATA_EXFILTRATION]: The skill manages sensitive API keys (X2C, Anthropic, Gemini) by storing them in a local credentials/ directory organized by user ID. It performs network requests to ukbyfmmerxhlghlhbxtz.supabase.co (Supabase) and generativelanguage.googleapis.com (Google Gemini) for functional purposes such as account validation and AI evaluation. These operations target well-known services and do not access unauthorized system files.
[COMMAND_EXECUTION]: The skill uses Node.js child_process.execSync within auto-iterate.js and ad-account-manager.js to orchestrate internal script workflows. These calls are limited to executing other scripts within the same skill package (e.g., ad-producer.js) and do not process arbitrary or unsanitized shell commands from external sources.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (story ideas and prompts) which are then interpolated into API calls for script and video generation. While this presents an injection surface common to AI agents, the skill follows a specific production workflow and utilizes guardrails in its internal guidance (e.g., AD-WRITER-GUIDE.md) to restrict output formats.
[DYNAMIC_EXECUTION]: The auto-iterate.js script implements a feedback loop where AI-generated evaluations are used to modify prompts for subsequent generation cycles. This is a standard functional pattern for quality-controlled AI generation and does not involve runtime compilation of untrusted code or unsafe deserialization.

ai-director