The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The embed_assets.py script allows fetching images from remote URLs using urllib.request.urlopen. This is a build-time feature for inlining assets into the final HTML file and is protected by a mandatory --allow-network flag to prevent unauthorized network activity.
[COMMAND_EXECUTION]: The skill utilizes the Playwright library for automated browser checks in verify_html.py and for exporting artifacts to PDF or PNG in export_html.py. These operations are strictly for verifying the generated HTML's visual integrity and performing exports.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied content to generate presentations and documents. It mitigates potential injection or cross-site scripting risks by employing a custom lexical preflight and a strict element/attribute allowlist that rejects ambiguous or dangerous HTML constructs before they can be rendered.
[DYNAMIC_EXECUTION]: During the verification stage, verify_html.py uses Playwright's browser automation capabilities (evaluate and wait_for_function) to inspect the DOM of the generated artifact. This is used to detect runtime issues like layout overflows and console errors within a sandboxed environment where network egress is explicitly blocked.

single-html-forge