The Agent Skills Directory

[SAFE]: The skill instructions and provided examples are focused solely on formatting input data into specific ASCII and JSON structures. No malicious command execution, data exfiltration, or prompt injection patterns were identified.
[DYNAMIC_EXECUTION]: The skill generates a domain-specific language (DSL) output under PENCIL_BATCH_DESIGN (e.g., root=G(), screen=I(...)). This is a template-based script generation for use with external drawing tools (Pencil MCP) and does not involve the execution of untrusted code within the skill environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided JSON input to generate UI specs. While it lacks explicit sanitization instructions or boundary markers for external data, it does not possess capabilities (such as network or file system access) that could be exploited through injection, making the surface risk negligible.

tui-avatar