The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill generates HTML preview artifacts that load the UnoCSS runtime and Mermaid.js library from the jsDelivr CDN.
Evidence: Template code in scripts/canvas-relay.ts includes script tags for https://cdn.jsdelivr.net/npm/@unocss/runtime and https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.min.js to enable runtime styling and diagram rendering.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as design briefs, project configuration JSON files, and component HTML snippets to generate design outputs. This creates a surface for processing untrusted content that might contain malicious instructions.
Ingestion points: User-provided design briefs, brand configuration JSON files (templates/design-tokens-starter.json), and user-supplied component code in scripts/canvas-relay.ts.
Boundary markers: Extensive mode-specific playbooks in the references/ directory provide a structured framework for the agent, reducing the likelihood of deviating from intended tasks.
Capability inventory: The skill utilizes file system read/write tools and shell command execution to automate design audits and asset scaffolding.
Sanitization: The canvas-relay.ts engine implements a strict Content Security Policy (CSP) and includes a "tripwire" audit function that scans input content for hardcoded secrets, such as API keys and private keys, using regular expressions.
[DYNAMIC_EXECUTION]: The skill's 'canvas' mode uses an engine that dynamically constructs HTML documents to provide responsive previews of UI components.
Evidence: scripts/canvas-relay.ts reads user-provided component files and interpolates the code into a standalone HTML preview structure. This behavior is documented and mitigated through the engine's built-in sandbox security features.

design