The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from customer reviews and ad comments stored in inputs/reviews/ and inputs/comments/. This represents a potential attack surface where malicious instructions embedded in reviews could influence the agent's behavior during generation or analysis.
Ingestion points: Reads files from inputs/reviews/ and inputs/comments/ (SKILL.md).
Boundary markers: The skill emphasizes 'Grounding' but lacks explicit instructions to treat embedded text as data only, increasing the risk of the agent obeying instructions hidden in review text.
Capability inventory: The skill can execute various ad platform CLI tools (google-ads, meta-ads, linkedin-ads, tiktok-ads) and write files to the local system.
Sanitization: While the HTML review template includes output escaping, the prompt interpolation for generating new ads does not specify sanitization for the inputs.
[EXTERNAL_DOWNLOADS]: The documentation in references/imessage-video-ads.md recommends installing external tools via npx gooseworks install --all. This pattern encourages the download and execution of code from an unverified package on the NPM registry.
[REMOTE_CODE_EXECUTION]: In references/generative-tools.md, the skill suggests building the 'Voicebox' tool by cloning its repository (git clone https://github.com/jamiepine/voicebox.git) and running build commands (make setup && make dev). This involves executing code from an unverified GitHub repository.
[COMMAND_EXECUTION]: The skill relies on executing various local command-line interfaces for ad platforms to pull performance data and manage campaigns. While these are primary functions, the ability to execute shell commands (node tools/clis/...) could be exploited if an injection attack occurs.

ad-creative