The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a local wrapper script located at scripts/api-request.sh for all communications with the Spotify Ads API.
[DYNAMIC_EXECUTION]: Within the Setup section of SKILL.md, the instructions direct the agent to use eval $(api --env) to dynamically assign environment variables such as tokens and account IDs from the output of a local script.
[INDIRECT_PROMPT_INJECTION]: The skill's build operation ingests unstructured user descriptions to generate campaign hierarchies, which could be exploited to deliver malicious instructions.
Ingestion points: User-supplied plain-text campaign descriptions processed by the build command defined in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to ensure the agent ignores or sanitizes instructions embedded within the user's description.
Capability inventory: The skill maintains capabilities to execute shell commands via Bash (specifically for API requests) and read local filesystem content via the Read tool.
Sanitization: The skill does not describe any specific validation or escaping mechanisms for the natural language input before it is used to determine API request parameters.

drafts