The Agent Skills Directory

[SAFE]: The skill instructions and referenced files focus entirely on the stated purpose of ad creative generation and performance analysis.
[EXTERNAL_DOWNLOADS]: The skill references several well-known technology providers (Google, OpenAI, Meta, LinkedIn, TikTok, ElevenLabs, Replicate) and official documentation for their APIs. These are standard industry tools for the skill's domain.
[COMMAND_EXECUTION]: The documentation provides example CLI commands for interacting with ad platforms (e.g., google-ads.js) and generative APIs. These examples use proper secret management practices by utilizing environment variable placeholders (e.g., $GEMINI_API_KEY).
[DATA_EXPOSURE_AND_EXFILTRATION]: No attempts to access sensitive system files (~/.ssh, ~/.aws, etc.) or exfiltrate user data were found. The skill gathering context about products and marketing is standard for its creative purpose.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it is designed to ingest and analyze external performance data (CSV, API outputs). However, this is its primary function, and no exploitable capabilities were identified that would escalate this to a significant risk.

ad-creative