The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and fetches assets from external domains.
It loads CSS from https://fonts.googleapis.com (Google Fonts).
It fetches icons from a CDN at https://cdn.thesvg.org/icons/{slug}.svg.
[COMMAND_EXECUTION]: The skill interacts with the thesvg MCP (Model Context Protocol) toolset to perform icon searches and retrievals (search_icons, get_icon).
[PROMPT_INJECTION]: The skill processes untrusted user input (oral thoughts, project outlines) to generate executable HTML files. This creates a surface for indirect prompt injection where malicious instructions could be embedded in project data.
Ingestion points: User-provided chat text and logic outlines described in the '触发条件' (Trigger Conditions) section of SKILL.md.
Boundary markers: The skill implements a two-step process requiring user confirmation of a '看板蓝图' (Board Blueprint) before code generation, which serves as a human-in-the-loop validation step.
Capability inventory: The agent is authorized to call the thesvg MCP and write files to the local 00_专注区/ directory.
Sanitization: There are no explicit instructions for the agent to sanitize or escape HTML entities from user-provided content before interpolation into the board template.

xiaoqi-board