The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions recommend the download and installation of tools and code from non-trusted external sources.
It directs users to use npx gooseworks install --all to install a third-party ad-creative pipeline.
It suggests cloning the voicebox repository from github.com/jamiepine/voicebox.git for on-device voice synthesis.
It references the super-video-maker skill from the repository github.com/Bomx/super-video-maker-skill.
[REMOTE_CODE_EXECUTION]: The workflow for producing iMessage-style ads involves running npx gooseworks install --all, which facilitates the download and immediate execution of scripts from an unverified third-party provider.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for automating ad production and performance analysis.
Instructions include command-line examples for interacting with google-ads, meta-ads, linkedin-ads, and tiktok-ads CLIs.
Provides commands for image generation using the Gemini API and video rendering via npx remotion render.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its ingestion of untrusted external content.
Ingestion points: The skill reads data from local files such as inputs/reviews/ and inputs/comments/ to ground the ad generation process.
Boundary markers: There are no explicit boundary markers or instructions to the agent to disregard potential adversarial content within these ingested files.
Capability inventory: The skill utilizes subprocess calls to execute platform CLIs and performs network operations (via curl) to send data to external AI service providers.
Sanitization: While the included assets/creative-review-template.html implements an HTML escaping function (esc) for rendering, there is no validation or sanitization of input data before it is interpolated into prompts for the LLM to generate copy.

ad-creative