The Agent Skills Directory

[SAFE]: A thorough review of the skill instructions, reference documents, and utility scripts (ad_health_scorer.py and roas_calculator.py) confirms that the content is strictly focused on marketing campaign management and mathematical performance analysis. No suspicious command execution, unauthorized network requests, or credential exposure patterns were found.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential ingestion surface by instructing the agent to read marketing context from a local file. Ingestion points: The skill body directs the agent to read .claude/product-marketing-context.md if it exists. Boundary markers: The instructions do not define specific delimiters or guardrails to prevent the agent from obeying instructions embedded in that context file. Capability inventory: The skill is equipped with standalone Python scripts for KPI calculations that lack dangerous capabilities such as network access, filesystem writes outside of defined inputs, or shell command execution. Sanitization: No explicit filtering or sanitization of the external context file is implemented. Overall risk is safe due to the lack of exploitable tools.

paid-ads