The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the Tailwind CSS framework from https://cdn.tailwindcss.com and the Mermaid.js library from https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs for rendering styles and diagrams in the generated report.
[PROMPT_INJECTION]:
Ingestion points: The skill ingests content directly from the conversation history (such as plans, diffs, and user-provided notes) to populate the report templates (SKILL.md).
Boundary markers: There are no specific boundary markers or instructions to ignore embedded instructions when the conversation content is interpolated into the HTML template.
Capability inventory: The skill uses the Write tool to create and save .html files in the .reports/ directory.
Sanitization: Instructions in references/html-report.md specify escaping special characters (<, >, &) only for code and diff blocks. Other content fields, including report titles, context lines, and paragraph sections, lack explicit sanitization instructions, which allows for the potential injection of malicious HTML or scripts from untrusted conversation data.
[COMMAND_EXECUTION]: The generated reports include a built-in "Annotation Layer" script (defined in references/html-report.md) that manages user comments, persists data in localStorage, and interacts with the system clipboard. This script executes in the user's browser context whenever a generated report is opened.
[REMOTE_CODE_EXECUTION]: The Mermaid.js library is initialized with securityLevel: "loose" in the report template. This configuration is known to allow the execution of JavaScript embedded within diagram definitions, which poses a security risk if diagram content is derived from untrusted sources in the conversation context.

report-render