The Agent Skills Directory

[SAFE]: The skill implements a strict 'offline-only' security boundary for all generated artifacts. It includes a dedicated Python validation script (scripts/check_html_artifact.py) that uses regular expressions to detect and block remote network requests, external scripts (<script src=...>), remote stylesheets, and browser APIs like fetch, XMLHttpRequest, and WebSocket.
[SAFE]: The skill provides strong defensive instructions against indirect prompt injection. It explicitly directs the agent to treat all ingested data (such as web pages, logs, and code diffs) as untrusted and forbids the execution of any instruction-like text found within that content.
[SAFE]: The skill enforces best practices for privacy and credential safety. The documentation (accessibility-and-security.md) and core rules (SKILL.md) specifically prohibit the inclusion of secrets, tokens, or local credentials in the generated artifacts.
[SAFE]: The generated output is designed for offline portability. Every artifact is single-file by default or uses a localized bundle pattern with no shared external assets, ensuring that data remains local to the user's environment.

html-artifact