The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute curl commands directed at the official Spotify Ads API (api-partner.spotify.com). these commands are used to fetch assets, estimate audience sizes, and create campaign entities.
[CREDENTIALS_UNSAFE]: The skill reads sensitive information, including an access_token and ad_account_id, from local configuration files (e.g., .codex/spotify-ads-api.local.md). This is the intended method for the skill to authenticate with the Spotify platform.
[PROMPT_INJECTION]: The skill processes natural language campaign descriptions to populate API parameters, which creates a surface for indirect prompt injection.
Ingestion points: Plain-text campaign descriptions provided by the user via the argument-hint.
Boundary markers: None explicitly defined in the instructions; the skill relies on the agent's parsing capabilities.
Capability inventory: Subprocess execution via Bash (curl) and local file access via Read tool.
Sanitization: The skill implements several validation guardrails, such as checking for positive budget amounts and validating platform names. Crucially, the process requires a mandatory human-in-the-loop confirmation (Step 2) where the full parsed plan is displayed for user approval before any API calls are executed.

build-campaign