The Agent Skills Directory

[DYNAMIC_EXECUTION]: The shell script scripts/export-pdf.sh uses a heredoc to dynamically generate a complete Node.js application (export-slides.mjs) in a temporary directory and executes it using the node interpreter. This generated script performs complex tasks including starting an HTTP server and controlling a headless browser. Evidence: Lines 134-315 in scripts/export-pdf.sh define the Node.js script, which is executed on line 359 using node "$TEMP_SCRIPT".
[EXTERNAL_DOWNLOADS]: The PDF export utility script performs runtime installation of external packages and binaries from public registries to set up its execution environment. Evidence: scripts/export-pdf.sh contains npm install playwright (line 339) and npx playwright install chromium (line 347).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and render untrusted external data (PowerPoint files and user notes) into HTML presentations. The skill possesses capabilities to write files and execute local scripts, establishing a potential attack surface for indirect prompt injection if malicious content is processed. Ingestion points: PowerPoint file content extracted via scripts/extract-pptx.py and user-provided drafts mentioned in SKILL.md workflow. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the presentation templates. Capability inventory: The skill can execute shell scripts, Python scripts, and write to the local file system. Sanitization: No sanitization or content validation is performed on extracted text before interpolation into the html-template.md architecture.
[COMMAND_EXECUTION]: The skill uses operating system commands to automatically open generated HTML files and PDFs for the user. Evidence: SKILL.md uses open, xdg-open, and start (Step 7). scripts/export-pdf.sh similarly uses open or xdg-open (lines 383-387) to display the resulting PDF.

frontend-slides