The Agent Skills Directory

[SAFE]: The skill is entirely instructional, providing strategic and operational guidance for advertising on platforms like Google, Meta, and LinkedIn. No malicious code or commands were found.
[EXTERNAL_DOWNLOADS]: The skill includes reference documentation for setting up tracking tags for Google, Meta, LinkedIn, and TikTok. These are well-known, legitimate services, and the URLs provided point to official domains for their respective tracking scripts.
[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to consume data from local files such as .agents/product-marketing.md to inform its responses. While this is a potential attack surface, the behavior is part of the skill's core functionality for context gathering and no malicious instructions were detected within the skill itself.
Ingestion points: .agents/product-marketing.md, .claude/product-marketing.md, and product-marketing-context.md.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore malicious content within the ingested files.
Capability inventory: The skill integrates with advertising platform APIs via internal MCP tools.
Sanitization: No content sanitization or validation logic is specified for the ingested context files.

ads