The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input to generate portfolio content and code, which could be exploited to inject malicious scripts or instructions into the generated website.
Ingestion points: User-provided strings for 'Profession', 'Main Purpose', 'Projects', 'Bio', and 'Social Links' are collected in SKILL.md (Step 2: CONTEXT).
Boundary markers: Absent. The skill does not provide delimiters or instructions to the agent to treat the user input as data rather than instructions.
Capability inventory: The agent is capable of generating and writing React (TSX) components and CSS files (Step 5: BUILD).
Sanitization: Absent. There are no guidelines for the agent to sanitize, escape, or validate the user-provided text before interpolating it into the code templates.
[DYNAMIC_EXECUTION]: The skill involves the generation of functional code snippets (React/Next.js) based on templates and user input.
Evidence: SKILL.md contains templates for Hero, Scroll, and Project Card components using Framer Motion and React (Step 5: BUILD).
[EXTERNAL_DOWNLOADS]: The skill references external font resources from a well-known service.
Evidence: SKILL.md includes @import rules for fonts.googleapis.com. This is an established service and the reference is documented neutrally as a safe operation.

vibecode-portfolio