The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides explicit instructions to install and run third-party tools from unverified sources. This includes directing the user to run 'npx gooseworks install --all' in 'references/imessage-video-ads.md' and to clone the 'voicebox' repository from GitHub followed by 'make setup' and 'make dev' in 'references/generative-tools.md'. These actions involve executing external code outside the control of the skill or the trusted vendor list.- [PROMPT_INJECTION]: The skill's architecture relies on ingesting untrusted external content, specifically customer reviews and ad campaign comments from the 'inputs/reviews/' and 'inputs/comments/' directories. While the skill mandates 'grounding' in real assets, the inclusion of this third-party data into the agent's context without sanitization creates a significant vulnerability to indirect prompt injection.- [COMMAND_EXECUTION]: The skill references local CLI tools, such as 'node tools/clis/google-ads.js', and provides examples of executing shell commands to interact with ad platforms and generative APIs. These operations involve direct command-line execution based on skill instructions.- [EXTERNAL_DOWNLOADS]: The skill extensively references external providers for image, video, and audio generation. While many are well-known services (e.g., Google Gemini, ElevenLabs), the inclusion of unverified third-party projects like 'Bomx/super-video-maker-skill' as production templates introduces supply chain risks.

ad-creative