The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches runtime dependencies including GSAP, Three.js, and post-processing modules from the well-known jsDelivr CDN. It also loads web fonts from Google Fonts. These resources are standard for the skill's purpose of 3D visual rendering and originate from well-known services.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data through variables such as headline1, headline2, and font to customize the rendered output.
Ingestion points: Variables are retrieved via window.__hyperframes.getVariables() within canopy-part-title.html and parsed as JSON.
Boundary markers: Input is scoped to the visual rendering context; instructions within text variables are treated as literal strings for canvas drawing.
Capability inventory: Runtime capabilities are restricted to WebGL and Canvas 2D rendering. No file system access, network exfiltration, or subprocess execution capabilities are present in the provided scripts.
Sanitization: The skill sanitizes the font variable by stripping quotes and uses encodeURIComponent when constructing requests for external font resources. Headlines are rendered using the Canvas 2D fillText method, which prevents the interpretation of input as executable HTML or JavaScript code.

canopy-part-title