The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the Meta Ad Library (ad text, headlines, and video transcripts) to analyze competitor strategies. There is a risk that malicious instructions embedded within competitor ads could influence the agent's behavior, as no specific prompt boundary markers or sanitization routines are implemented to isolate this external data from the agent's instructions.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality. scrape.sh invokes npx, curl, and sed to interact with web content and download media. transcribe.py uses subprocess.run to call ffmpeg for audio extraction and the whisper CLI for local transcription.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute agent-browser, which may download the package at runtime if not already installed. It also explicitly suggests that users install external dependencies such as ffmpeg and openai-whisper via system package managers or pip.
[DYNAMIC_EXECUTION]: The scrape.sh script executes a complex, multi-line JavaScript snippet within the browser environment using the agent-browser eval command to parse and extract data from the Meta Ad Library DOM.
[DATA_EXFILTRATION]: The skill reads audio data from processed video ads and transmits it to the OpenAI API for transcription when an API key is configured. This involves sending local data to a well-known external service as part of the intended workflow.

ad-spy