The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements secure credential management by instructing users to use environment variables and .env files for API keys. It includes explicit warnings against logging authorization headers or hardcoding secrets.
[EXTERNAL_DOWNLOADS]: The skill fetches ad media and metadata from official vendor domains (api.novoads.ai) and Meta's CDN. These operations are core to the skill's function and target well-known or vendor-owned infrastructure.
[COMMAND_EXECUTION]: The skill utilizes local shell commands (curl, jq) and repository-provided scripts (sweep.py, rank-ads.py, make-picker.py) to manage API requests and process output files. These actions are scoped to the intended functionality of an ad-spying tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Meta Ad Library, including ad copy and page names, which presents a surface for indirect injection.
Ingestion points: External data is ingested through the Novoads API and saved to local JSON files (sweep.json).
Boundary markers: The instructions mandate manual and script-based verification to group results and filter out unrelated same-name strangers.
Capability inventory: The skill has the capability to perform network requests, write to the filesystem, and execute local scripts.
Sanitization: Data is parsed using jq and ranked via metadata-driven scripts (focusing on collation counts and dates) rather than free-text interpretation of the ad content.

spy-competitor-ads