The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string (encodedHtml) representing the complete HTML structure of the interactive design demo. This is a common packaging method used by design vendors to bundle previews into a single loader script.
[EXTERNAL_DOWNLOADS]: The skill's demo configuration in demo/source.json and the decoded demo template reference external assets and scripts from well-known services, including Cloudflare's CDN, Tailwind CSS, Google Fonts, and Fontshare. These are standard resources for modern web development.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves generating HTML designs from a combination of external asset metadata and user-supplied prompts. This creates a surface for processing untrusted data, though the risk is addressed through technical controls in the demo environment.
Ingestion points: Metadata in demo/source.json and user-driven prompts in demo/PROMPT.md.
Boundary markers: No explicit delimiters are used to separate instructional content from untrusted input data.
Capability inventory: The system generates and executes HTML/JavaScript within a sandboxed <iframe> managed by demo/index.html.
Sanitization: The demo environment implements a restrictive Content Security Policy (CSP) via the srcdoc attribute to limit the scope of execution.
[DYNAMIC_EXECUTION]: The demo loader in demo/index.html dynamically decodes the Base64 payload and injects it into an iframe using the srcdoc attribute. It also uses URL.createObjectURL to map base64-encoded assets to runtime URLs, which is a standard approach for handling bundled media in sandboxed environments.

technical-wireframe-info-layout