The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied .deck.md files to generate content for slides.
Ingestion points: The scripts/render.mjs script reads the content of the deck file provided as a command-line argument.
Boundary markers: The deck format uses specific block delimiters (::: layout), but there are no explicit security boundary instructions for the agent regarding the content.
Capability inventory: The skill utilizes child_process.spawnSync to invoke a browser for rendering and the fs module to create output directories and files.
Sanitization: Slide content is passed through an escapeHtml function before being interpolated into the rendering HTML.
[COMMAND_EXECUTION]: The renderer script executes external commands to locate and run a browser.
The script uses child_process.spawnSync to run the which utility to find browser binaries like google-chrome or chromium.
It subsequently executes the identified browser binary with flags such as --headless, --screenshot, and --print-to-pdf to generate the final assets.
[EXTERNAL_DOWNLOADS]: The skill fetches external assets from a well-known service during the rendering process.
The assets/theme.css file imports fonts from fonts.googleapis.com. The documentation explicitly mentions that the initial render requires network access to download these fonts.
[DYNAMIC_EXECUTION]: The skill generates and executes dynamic content at runtime for layout management.
The render.mjs script assembles HTML files for each slide and injects a JavaScript snippet (FIT_SCRIPT) designed to automatically shrink text that overflows its container. This script is executed within the headless browser environment during the rendering phase.

carousel-press