The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via HTML injection. User-supplied inputs such as headlines and logo URLs are directly interpolated into HTML templates without any sanitization or escaping. This allows an attacker to inject malicious HTML or JavaScript into the rendered ad creative.
[COMMAND_EXECUTION]: The skill utilizes the Playwright MCP for rendering and capturing screenshots. It explicitly instructs the user to configure the tool with the --allow-unrestricted-file-access flag. This configuration bypasses standard browser security sandboxes, granting the browser access to the entire local file system.
[DATA_EXFILTRATION]: The combination of unsanitized HTML generation and a browser environment with unrestricted file access creates a high risk of local data exfiltration. If malicious JavaScript is injected through a headline, it could potentially read sensitive local files (such as SSH keys or environment variables) and transmit them to a remote server during the automated rendering process.
[PROMPT_INJECTION]: Indirect Prompt Injection Analysis:
Ingestion points: Headlines, Logo URLs, and Product Image paths provided by the user in Step 1.
Boundary markers: None. The skill does not use delimiters or instructions to the agent to ignore embedded commands in user input.
Capability inventory: The skill writes local HTML files (ad-{slug}.html) and uses Playwright to execute/render them with full file system access.
Sanitization: None. There is no mention of escaping HTML special characters or validating URL protocols.

ad-creative