The Agent Skills Directory

[SAFE]: The skill is focused on campaign planning and explicitly prohibits unauthorized actions on ad accounts, spending, or data storage. The instructions emphasize that live account access and budget spend are strictly forbidden without explicit approval.\n- [COMMAND_EXECUTION]: The validation section in SKILL.md contains shell commands for linting and validating the skill using local scripts defined via the $CODEX_HOME environment variable. These are standard development practices for the environment and do not pose a security threat.\n- [DATA_EXFILTRATION]: No evidence of data exfiltration or sensitive file access was found. The skill includes specific rules against storing credentials, tokens, or customer lists.\n- [PROMPT_INJECTION]: The skill processes website data and landing page requirements for planning, which is a potential surface for indirect prompt injection. However, the risk is negligible as the skill lacks high-privilege tools or external network capabilities. Evidence: Ingestion points: website planning needs and landing page data; Boundary markers: safety rules and the paid-traffic-safety-contract.md reference; Capability inventory: local validation scripts only; Sanitization: logical separation of planning from execution.

paid-traffic-architect