The Agent Skills Directory

[SAFE]: The skill provides UI animation logic using the well-known GSAP library. All DOM manipulation is handled locally within the browser context to modify text presentation for animation purposes.
[INDIRECT_PROMPT_INJECTION]: The skill ingests text content from the DOM using element.textContent. While this represents an ingestion point for untrusted data, the skill mitigates cross-site scripting (XSS) risks by using a dedicated escapeHTML function to sanitize word parts before they are re-injected into the DOM via innerHTML.
[COMMAND_EXECUTION]: The skill contains no shell commands, subprocess calls, or system-level execution patterns. It is limited to standard JavaScript DOM API and animation library calls.
[DATA_EXFILTRATION]: There are no network operations, such as fetch, XMLHttpRequest, or curl. The skill does not access sensitive local files or environment variables, posing no risk of data exposure or exfiltration.

masked-reveal