The Agent Skills Directory

[PROMPT_INJECTION]: The skill incorporates user-provided identifiers (e.g., advertiser-id, campaign-id) into shell command templates and temporary JSON files, creating an indirect prompt injection surface.
Ingestion points: Placeholders like {advertiser-id} and {campaign-id} in SKILL.md are intended to be filled with user input.
Boundary markers: There are no specific delimiters or instructions for the agent to treat this content as untrusted data.
Capability inventory: The skill utilizes curl for network requests and cat for file creation in the /tmp/ directory.
Sanitization: No sanitization or validation steps are defined for the input placeholders.
[COMMAND_EXECUTION]: The skill utilizes shell commands (curl, jq, cat) to communicate with the TikTok Ads API and manage local data. This is expected behavior for a CLI-integrated skill.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to https://business-api.tiktok.com, which is the official endpoint for the TikTok Business API. These connections are necessary for campaign management.

tiktok-ads