The Agent Skills Directory

[OBFUSCATION]: The demo/index.html file utilizes a large Base64-encoded string (encodedHtml) to store the reference design and associated logic, which includes executable JavaScript for Three.js and GSAP.
[EXTERNAL_DOWNLOADS]: The skill references assets and runtime dependencies from trusted services including Google Fonts, Cloudflare (cdnjs), Supabase, and Iconify. These resources are utilized for fonts, styling, and graphics processing.
[REMOTE_CODE_EXECUTION]: The skill dynamically injects external graphics libraries (Three.js, GSAP, Tailwind) into a sandboxed iframe to render the laser effects, which constitutes a remote code execution pattern despite the use of trusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its asset processing logic.
Ingestion points: Data enters the agent context via window.addEventListener("message", ...) in demo/index.html, which receives Base64-encoded assets.
Boundary markers: The script verifies the message source (parent) and a specific data type (neuform-assets-v1).
Capability inventory: Capabilities are restricted to DOM manipulation and object URL creation; no file system or subprocess capabilities were identified.
Sanitization: The implementation lacks sanitization or validation of the asset content before converting it into Blobs for rendering.

corner-lasers