The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to graph.facebook.com. This is the official endpoint for Meta's Marketing API and is a well-known service necessary for the skill's primary function of uploading ad creatives.
[CREDENTIALS_UNSAFE]: Secret management is handled correctly using environment variables (ACCESS_TOKEN, AD_ACCOUNT_ID) as defined in the YAML frontmatter. Documentation examples use benign placeholders, and the skill encourages the use of .env files for local development, which is a standard and safe practice.
[COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as curl for API interaction, jq for JSON processing, and identify (ImageMagick) or python3 (Pillow) for local image validation. These tools are invoked within a defined scope to perform expected tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local campaign files and asset specifications.
Ingestion points: Reads campaign data from workspace/brand/ and workspace/campaigns/*/ads/*.json.
Boundary markers: Explicit boundary markers for LLM instructions are not defined, but the skill uses structured JSON and strict field validation.
Capability inventory: Limited to Meta Graph API operations, file-system reads/writes within the workspace, and local image processing tools.
Sanitization: Implements significant validation logic including character limits for headlines/bodies, file size and dimension checks for images, and restricted Call-To-Action (CTA) types.
[SAFE]: The skill emphasizes a 'dry-run' and 'paused-only' workflow, ensuring that no live changes occur without explicit user approval in the Meta Ads Manager UI.

ad-upload