The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches stock images from Pexels, a well-known service, for use as slide backgrounds. It also references font and script assets from Google Fonts and jsDelivr's CDN. These are documented as standard design assets.
[COMMAND_EXECUTION]: The slide-token-validator.py script executes a local sibling script, html-token-validator.py, using subprocess.run. This execution is restricted to the local Python environment for the purpose of validating design compliance.
[INDIRECT_PROMPT_INJECTION]: The slide generation process ingests user-provided text and JSON configuration, creating a surface for indirect injection.
Ingestion points: User commands for slide creation and local design-tokens.json files.
Boundary markers: The skill implements explicit HTML escaping for all user-supplied fields.
Capability inventory: Includes reading/writing local project files and executing local validation scripts.
Sanitization: Comprehensive sanitization is present in generate-slide.py via the _e() helper for HTML escaping and _safe_url() for protocol verification (allowing only http/https/relative links).

design-system