The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses configuration and metadata files within the user's home directory.
Evidence: The instructions involve reading from and writing to ~/.banana/presets/, ~/.banana/costs.json, and ~/.claude/skills/ads/references/ to manage generation parameters and tracking spend.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external files to drive agent behavior and task spawning.
Ingestion points: Processes campaign-brief.md for generation instructions and brand-profile.json for style attributes.
Boundary markers: No delimiters or isolation instructions are specified to prevent the agent from following malicious commands embedded within the campaign briefs.
Capability inventory: The skill has the ability to spawn new agent tasks (visual-designer, format-adapter) with shared context, write multiple files to the local directory, and invoke the banana-claude image generation tool.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content extracted from the brief files before it is used to construct prompts for sub-agents.
[COMMAND_EXECUTION]: The skill references a local Python script as a fallback execution path.
Evidence: Mentions scripts/generate_image.py as a deprecated alternative if the primary image provider tool is unavailable.

ads-generate