The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted markdown content, creating a surface for indirect prompt injection where malicious instructions or scripts could be embedded in the data.
Ingestion points: The render_report.ts entry point reads user-provided Markdown content from the file system using Deno.readTextFile.
Boundary markers: The skill converts Markdown into a standalone HTML file. It uses distinct components like renderMarkdown and hastToHtml to manage the conversion process.
Capability inventory: The skill requires high permissions (deno run -A) to perform file system operations, including reading input and writing output (Deno.writeTextFile in render_report.ts). The documentation also suggests the agent execute platform-specific commands (open, xdg-open, start) to display the final report.
Sanitization: While the skill implements HTML escaping for metadata (title, author, subtitle) in lib/report_generator.ts and lib/hast_to_html.ts, the HAST-to-HTML pipeline in lib/hast_to_html.ts explicitly includes a raw node type that returns values without escaping. If the Markdown parser (satteri) preserves HTML blocks from the input, these could be rendered directly into the output report, enabling cross-site scripting (XSS) if the report is viewed in a browser environment.

hand-drawn-report