The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the HyperFrames CLI from the official NPM registry and the GSAP library from jsDelivr. These are well-known and trusted package distribution services.
[COMMAND_EXECUTION]: Project scaffolding and rendering require executing node and npx commands. The build.mjs script implements security checks to prevent writing to symbolic links, which protects against directory traversal and unauthorized file overwrites.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection through the ingestion of external data. Ingestion points include social media content (TikTok, Instagram) fetched via tools like yt-dlp. While boundary markers for the HTML slots are absent, the skill's capability inventory is limited to local file writing and rendering, and it includes basic sanitization for project IDs. This is considered a low-risk surface given the intended use case for mock-up generation.
[DYNAMIC_EXECUTION]: The build.mjs script performs dynamic string replacement on a pre-defined HTML template to initialize projects. This is a standard and safe practice for configuring web-based templates.

duo