The Agent Skills Directory

[SAFE]: The skill includes explicit security guidelines to prevent Cross-Site Scripting (XSS) in the generated HTML artifacts. It instructs the agent to use textContent and document.createElement while strictly forbidding the use of innerHTML with any variable or user-provided data.
[SAFE]: The instructions minimize the attack surface by requiring the generated artifacts to be self-contained. It restricts external resources to Google Fonts via <link> tags and explicitly forbids loading code from CDNs or npm registries unless specifically requested.
[DATA_EXFILTRATION]: No exfiltration or credential access patterns were detected. The skill mandates that the artifacts operate without persistent browser storage (like localStorage or IndexedDB), ensuring data remains isolated within the static file.
[PROMPT_INJECTION]: While the skill processes user-supplied data to generate documentation, it includes clear sanitization requirements and boundary instructions that mitigate the risk of indirect prompt injection in the resulting artifacts.

html-design-tokens