The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/creative-monitor.sh dynamically computes a root directory path using parent directory traversal (../../../). It then attempts to execute an external shell script meta-kit.sh from that computed location. This execution of code outside the skill's own folder structure is a security risk as it depends on the environment's directory layout and could execute untrusted scripts if the parent directories are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external ad performance data (CTR, CPC, and frequency trends). This ingestion creates a surface for indirect prompt injection where malicious instructions could be embedded in the data processed by the agent.
Ingestion points: Ad-level insights and performance metrics pulled via meta-kit.sh as described in SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the skill's logic.
Capability inventory: The skill possesses the ability to execute shell commands via bash and write results to the local filesystem (workspace/brand/learnings.md).
Sanitization: There is no evidence of sanitization, escaping, or strict validation of the external metrics before they are interpreted by the agent.
[COMMAND_EXECUTION]: The skill uses bash to run local scripts and passes user-supplied or data-driven arguments ($@) to external commands. This pattern increases the risk of command injection if input parameters are not strictly validated.

ad-creative-monitor