The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data verbatim to generate ad creative, creating a surface for potential injection.
Ingestion points: Reads customer reviews from inputs/reviews/ and campaign comments from inputs/comments/ to ground copy in authentic language (SKILL.md).
Boundary markers: The creative-review-page.md reference and creative-review-template.html include specific instructions to escape HTML characters (e.g., using \u003c and a custom esc() function) when populating the review artifact to prevent script injection.
Capability inventory: The skill performs file writes to dated output folders, executes network requests via curl to external AI APIs, and manages ad platform campaigns using internal node CLI tools (SKILL.md, references/generative-tools.md).
Sanitization: Implements an esc function in the HTML template's JavaScript to sanitize data before rendering to the DOM.
[EXTERNAL_DOWNLOADS]: The skill references and provides instructions for utilizing several external tools, libraries, and services.
Includes setup instructions for npx gooseworks install, npx create-video (Remotion), and cloning the voicebox repository from GitHub (references/imessage-video-ads.md, references/generative-tools.md).
Mentions numerous well-known AI services (Google Gemini, OpenAI, ElevenLabs, Runway, Flux, Ideogram) for generating ad assets.
[COMMAND_EXECUTION]: Multiple shell command examples are provided for the agent or operator to perform administrative and generative tasks.
Provides curl examples for interacting with external APIs and node command examples for campaign management via provided CLI tools (SKILL.md, references/generative-tools.md).
[DYNAMIC_EXECUTION]: The skill generates a self-contained HTML review page that executes JavaScript to render ad mockups.
The assets/creative-review-template.html file uses a data-driven rendering approach where concept data is parsed from a JSON block at runtime. The skill specifically instructs the agent on how to populate this data safely to avoid breaking the execution context.

ad-creative