The Agent Skills Directory

[SAFE]: The skill actively enforces security best practices by instructing the agent to use textContent and document.createElement instead of innerHTML when handling variable data, which effectively mitigates XSS risks in the generated output.
[SAFE]: The skill restricts the use of external assets to well-known services (Google Fonts) and explicitly prohibits browser-side persistence APIs such as localStorage and IndexedDB, minimizing the attack surface of the generated artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external source material, such as codebase excerpts or articles, to generate presentation content.
Ingestion points: User-provided source material (articles, codebases, or notes) referenced in the prompt (SKILL.md).
Boundary markers: None explicitly defined to separate source content from system instructions.
Capability inventory: The skill writes self-contained HTML files with embedded JavaScript but does not perform shell command execution or non-whitelisted network operations.
Sanitization: The skill contains mandatory instructions to build the DOM safely using textContent and appendChild, preventing any malicious code in the source material from being executed as part of the slideshow logic.

html-slideshow-deck