The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's entry scripts (scripts/get_sp_audience_report.py and scripts/get_sp_search_impression_share.py) use subprocess.run to execute a local dependency checker script (scripts/check_auth_dependency.py). This execution is limited to verifying the installation of a required authentication skill, uses the current Python interpreter, and targets a fixed local path, which is a secure implementation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external CSV report data from the Amazon Ads API. This data is parsed by scripts/reporting_v1_workflow.py to generate summaries and previews for the agent. While this represents a potential injection surface from third-party advertising data, the skill mitigates risk by returning structured JSON data and using standard CSV parsing libraries rather than passing raw content directly to the prompt.
[DATA_EXFILTRATION]: The skill performs network operations to tool-gateway.linkfox.com and api.linkfox.com to proxy requests to the Amazon Ads API and handle account onboarding. These communications target the vendor's official infrastructure. Sensitive user identifiers and API keys are managed via environment variables and are not hardcoded within the scripts.
[SAFE]: The skill implements specific security logic in scripts/reporting_v1_workflow.py to redact pre-signed Amazon S3 URLs from logs and recursively reject sensitive Amazon credentials (like LWA secrets or access tokens) if they are accidentally passed into the skill's parameters.

linkfox-amazon-ads-sp-insights-report