Update to JuicyLucy Ads

{
  "description": "Analyze an ad account's static-ad performance through the platform's marketing API under a strict read-only contract, to select fresh winning static concepts for iteration. Use when retrieving insights, ads, creatives, and previews to rank winners, deduplicating localized executions into unique concepts, maintaining an unused-winner ledger, or verifying a winner's creative before it becomes a generation reference — without creating, editing, publishing, pausing, budgeting, or otherwise mutating anything in the account. Also use whenever someone asks to pause, resume, edit, or re-budget an ad, ad set, or campaign, or pastes an ad-platform access token into the conversation: this skill holds the rule that such a change is declined and pointed to the platform's own manager, and that a pasted token serves reads only and is never persisted or repeated.",
  "included_files": [],
  "name": "static-winner-analysis",
  "skill_md_contents": "---\nname: static-winner-analysis\ndescription: Analyze an ad account's static-ad performance through the platform's marketing API under a strict read-only contract, to select fresh winning static concepts for iteration. Use when retrieving insights, ads, creatives, and previews to rank winners, deduplicating localized executions into unique concepts, maintaining an unused-winner ledger, or verifying a winner's creative before it becomes a generation reference — without creating, editing, publishing, pausing, budgeting, or otherwise mutating anything in the account. Also use whenever someone asks to pause, resume, edit, or re-budget an ad, ad set, or campaign, or pastes an ad-platform access token into the conversation: this skill holds the rule that such a change is declined and pointed to the platform's own manager, and that a pasted token serves reads only and is never persisted or repeated.\n---\n\n# Static Winner Analysis — read-only\n\nRetrieve what is working, prove it, and hand the pipeline a deduplicated,\nevidence-backed winner list. This skill holds the permission boundary and the\ncredential rules for every ad-account read the statics pipeline performs.\n\n## Decide this first\n\nTwo things arrive here that this skill never acts on. Settle them before any\ncommand runs, because each is decided once, in the reply, and not revisited\nwhen a permission, the network, a connector, or a confirmation turns up later.\n\n- **A change to the account — pause, resume, edit, publish, budget, delete,\n  duplicate, upload, or anything else that alters an object or its\n  delivery.** This skill makes no write of any kind: not for an urgent\n  request, not with the user's explicit permission, not after a\n  confirmation. Decline it in the reply, say in one line that this route is\n  read-only, and point to where the change is made — the ad platform's own\n  manager (for Meta, Ads Manager: find the ad set and switch it off) or a\n  person with write access to the account. Describing those steps in the\n  platform's interface is the only how-to you give. Never:\n  - call anything that writes, however it is labelled (\"only a lookup first\");\n  - offer to make the change later — once the user allows a host, grants a\n    permission, connects something, or confirms the exact object;\n  - hand the user a write to perform themselves — no `curl`, script, API\n    request, SDK snippet, or URL that changes anything, with or without the\n    token in it.\n\n  A request that is both — \"pause it, and show me how it did\" — gets its\n  read half through the supported route below and its write half declined.\n- **A token pasted into the conversation.** It may serve this session's\n  read-only queries (§ The permission contract) and nothing else: it never\n  makes a write acceptable, and it is never persisted. Pass it at runtime\n  only, in an `Authorization: Bearer` header from a shell variable assigned in\n  the same command — never in a URL or query string (`access_token=`), never\n  written to a file, an environment file, a log or the manifest, never echoed\n  or printed, and never repeated in a reply, in whole or in part. It now sits\n  in the transcript, so when the analysis is done, tell the user to revoke it\n  and generate a new one, and say that an insights export or a connector\n  avoids pasting one next time.\n\n## The permission contract\n\n- **The read-only routes**, in order of preference: a connector the host\n  already has to the ad platform, which holds its own credentials; an\n  insights export from the platform's manager placed in the workspace, which\n  needs no credential at all; a token the session already holds outside the\n  conversation, used by reference (an environment variable's name); or a\n  token the user pastes for this session, used as § Decide this first says.\n  Never change the host's settings, permissions, or network allowlist to make\n  a route work. None of it is ever stored in a skill, config, manifest, or\n  artifact.\n- Once a supported route exists, read-only retrieval for winner analysis is\n  **standing-authorized**: run the GET requests the analysis needs without\n  re-asking per query. If the session has none, say so once and name the\n  routes above — an export is usually the quickest; a pasted token should\n  carry read permissions only.\n- **Read-only means read-only.** Retrieve account metadata, campaigns, ad\n  sets, ads, creatives and previews, insights, actions, spend, and conversion\n  fields. Never call anything that creates, updates, publishes, pauses,\n  resumes, deletes, duplicates, uploads, or adjusts any object, budget,\n  audience, billing, or delivery state. Writes are outside this skill\n  entirely — not a step it reaches with more permission — and the user makes\n  them in the platform's own manager (§ Decide this first).\n- State the read-only boundary in the run's manifest so the contract is\n  visible in the record.\n\n## Credential hygiene\n\n- Never write a token into a file, URL, log, filename, summary, command\n  echo, reply, or recorded artifact of any kind. A token the session holds is\n  referred to by name; a pasted one is passed in a header at runtime only\n  (§ Decide this first). Redact it from anything persisted.\n- Treat a token found in client-side or public configuration (for example a\n  browser-exposed environment variable) as compromised: do not use it, flag\n  it, and advise rotation.\n- Retain no login state, cookies, or session material after the run.\n\n## Retrieve and rank\n\n1. Query insights for the requested lookback window, restricted to static\n   image ads — media type is part of the query, not a post-filter hope.\n2. Parse results from the actual action/conversion fields; do not trust a\n   pre-aggregated column whose definition you have not checked.\n3. Rank on meaningful conversion volume **and** cost efficiency together.\n   Exclude under-delivered ads; never promote an ad because one conversion\n   produced a flattering cost figure.\n4. Open each shortlisted ad's creative preview and visually confirm it\n   corresponds to its performance row before treating it as a winner.\n\n## Deduplicate into concepts\n\nCluster by underlying creative concept before filling any slot: language,\ntranslated copy, localized names, and target market are execution attributes.\nOne concept, one slot — the strongest execution becomes the visual reference;\nthe other executions are cross-market validation, not additional winners.\n\n## The unused-winner ledger\n\nMaintain a dated ledger of ranked winners not yet iterated: concept, best\nexecution, evidence, and why it was passed over. It feeds the next cycle's\nrepeat-versus-explore decision, per the workspace evidence conventions\n(`juicylucy` skill, `evidence.json` § retention).\n\n## Record the evidence\n\nPer selected winner: account (by name, not token), reporting window, ad\nname/ID, results, spend, cost per result, return metrics when available,\npreview confirmation, concept-cluster name, deduplicated siblings, and the\nreference image path or capture. This record is what makes \"we iterated a\nwinner\" auditable later.\n\n## One winner, five variations\n\nA confirmed winner seeds a review cycle, not a clone: five materially\ndistinct variations — different composition, setting, typography, or copy\nangle around the same hypothesis — so the next report can say *why* it won,\nnot merely that it did. The mutation modes and master QA live in\n`static-ad-production`.\n\n## Guardrails\n\n- Product truth outranks performance: a winning claim the brand's\n  `product-truth.md` does not support is a rejected claim, however well it\n  converted. Resolve the brand skill before turning any winner into copy.\n- Never expose account data beyond what the run needs, and never paste raw\n  API responses containing identifiers into shipped artifacts.\n- A stale local asset is not a winner; when live access exists, the live\n  numbers decide.\n"
}