The Agent Skills Directory

[SAFE]: The skill is a set of design patterns and implementation guides for web theming. It contains no executable malicious code, credential harvesting, or unauthorized network operations.
[INDIRECT_PROMPT_INJECTION]: The skill describes a white-label architecture that ingests and injects tenant-specific theme values into a server-side rendered application. This creates a potential surface for indirect injection if tenant-controlled data is not properly sanitized.
Ingestion points: Tenant theme data is fetched via getTenantTheme(req.hostname) in the provided Express.js middleware example.
Boundary markers: The skill does not explicitly use LLM boundary markers as it focuses on standard web architecture, but it scopes overrides within the :root CSS selector.
Capability inventory: The system performs server-side HTML generation and CSS custom property injection.
Sanitization: The skill explicitly includes and recommends a sanitizeCssValue function to validate hex colors, rem/px lengths, and font names while rejecting arbitrary strings to prevent CSS/XSS injection attacks.

storefront-theming