The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded payload (encodedHtml) that encapsulates the entire HTML, CSS, and JavaScript source for the design demo. This technique hides the demo's internal logic and behavior from plain-text security scanners.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow in demo/PROMPT.md for generating functional HTML designs based on a 'Product brief' provided by the user. This creates an attack surface where a malicious brief could contain instructions that influence the agent to generate harmful or exploitative code.
Ingestion points: Product brief section in demo/PROMPT.md (concept, content anchors, and tags).
Boundary markers: Absent; there are no instructions for the agent to treat the brief content as untrusted data or to use delimiters to isolate it.
Capability inventory: The agent is expected to generate and deliver a complete index.html file with embedded JavaScript and CSS.
Sanitization: Absent; no sanitization or validation rules are provided for the generated output or the input data.
[EXTERNAL_DOWNLOADS]: The demo environment downloads configuration and runtime libraries from various third-party CDNs and services. It fetches fonts from Google's font services (fonts.googleapis.com, fonts.gstatic.com) and JavaScript libraries (GSAP, Three.js, Iconify) from Cloudflare and Iconify CDNs.

dither-laser-dark-mode