The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from diffs, commit messages, and PR descriptions. However, it implements strong mitigation by explicitly instructing the agent to treat these as data and never as instructions. It specifically warns that if a diff contains commands (e.g., 'run this command'), the agent should report it as suspicious behavior in the 'What could break' section rather than executing it.
[COMMAND_EXECUTION]: The skill uses a Python build script (scripts/build.py) to assemble the final output. The command execution is restricted to a local environment and the script enforces strict safety rules on the generated content.
[DYNAMIC_EXECUTION]: The build script performs static analysis on the model-generated HTML body. It rejects any input containing <script> tags, inline event handlers (like onclick), or remote asset URLs. This prevents the agent from being tricked into including malicious scripts in the output page.
[REMOTE_CODE_EXECUTION]: The skill design ensures the generated page works offline and forbids remote src or href attributes in the generated body. The CSS and JavaScript are restricted to a fixed, local template.

explain-diff