The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute npx hyperframes lint topics/<주제>. There is a risk of command injection if the <주제> (topic) placeholder, which typically comes from user input or project structure, is not sanitized before execution.
[EXTERNAL_DOWNLOADS]: The skill fetches a font stylesheet from cdn.jsdelivr.net/gh/fonts-archive/Paperlogy/subsets/Paperlogy-dynamic-subset.css. This is a standard use of a well-known CDN for assets and is considered safe.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to generate slide content and update system files, creating an attack surface for indirect injection.
Ingestion points: User requests for slide creation ("슬라이드 만들어줘"), deck updates, and overview synchronization.
Boundary markers: None are specified in the instructions to separate untrusted user input from the generated HTML/CSS code.
Capability inventory: The skill possesses the capability to write to the file system (modifying index.html and overview.html) and execute shell commands via npx.
Sanitization: No sanitization or validation steps are mentioned for content interpolated into the slide compositions or for arguments passed to the linting tool.
[DYNAMIC_EXECUTION]: The skill requires registering GSAP timelines to window.__timelines, which involves runtime script execution within the browser environment. This is consistent with the skill's stated purpose of creating animated slide decks.

hyperframes-slide