The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates and writes an HTML file (flow.html) containing inline JavaScript logic. This script is used to calculate coordinates and render SVG connectors for swimlane diagrams in the user's browser. Although the script includes a basic sanitization function (esc) for user-provided labels, the generation of executable web content within the user's workspace is a significant capability.
Evidence: references/swimlane.md defines a complete HTML document with a <script> block that performs DOM manipulation and SVG rendering logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user descriptions and local workspace files (e.g., Business-Profile.md, Employees/), which is then interpolated into prompts for a secondary "subagent" during the critique phase.
Ingestion points: User chat input (Beat 1), Business-Profile.md, and various asset lists in the vault.
Boundary markers: The prompt template in references/critique.md uses clear section headers like BUSINESS CONTEXT and OBJECTIVE to delimit injected data.
Capability inventory: The agent has the ability to create directories, glob the filesystem for draft states, and write both .md and .html files.
Sanitization: The skill explicitly instructs the agent to render flow data as plain text before passing it to the subagent to prevent the model from misinterpreting HTML/SVG markup as instructions.

sop-builder