The Agent Skills Directory

[SAFE]: The skill uses npm install playwright and npx playwright install chromium to set up its export tooling. These are official packages from the well-known Microsoft Playwright project, which is a standard industry tool for browser automation and screenshot generation.
[SAFE]: The preview server (serve.mjs) is a minimal, zero-dependency Node.js script that strictly serves files from the local project directory. It includes path normalization checks (!file.startsWith(ROOT)) to prevent path traversal attacks, ensuring that an attacker cannot access files outside the intended carousel folder.
[SAFE]: The instructions regarding the higgsfield MCP server refer to an official integration (mcp.higgsfield.ai). The skill directs the user to perform the login and credit top-up via their own browser, ensuring the agent never handles sensitive credentials or payment data directly.
[SAFE]: The skill's primary function is generating HTML and CSS for social media posts. All scripts provided (export.mjs, export.py, serve.mjs) are transparent, well-documented, and serve the stated purpose of rendering and exporting image slides without any hidden or obfuscated behaviors.

carousel-generator