The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data to generate HTML content which is then rendered into images, creating a potential surface for indirect injection.
Ingestion points: User-supplied strings for variables such as {{headline}}, {{tagline}}, {{accent_text}}, and {{highlight_text}} are interpolated into HTML templates found in the references/ directory (e.g., references/wechat/grid/template.html).
Boundary markers: The skill uses double-brace placeholders (e.g., {{headline}}) as delimiters in the template files, but does not provide explicit instructions to the agent to sanitize or ignore embedded instructions within the user-provided text.
Capability inventory: The skill calls the html-to-image-render tool to perform the rendering and writes output files to the local text-card-images/ directory.
Sanitization: There is no evidence of input validation or sanitization logic to prevent the injection of malicious HTML or CSS through the user-provided variables.

text-card