The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several local bash scripts (build-html.sh, assemble.sh, validate-design.sh, init-room.sh) to automate the project lifecycle, from initializing project directories to the final assembly of the HTML presentation. These scripts are bundled within the skill's own package and are used solely for project management and build tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content from deck.md and user-provided design references. It mitigates potential injection risks by employing a quality gate in build-html.sh that performs static analysis on the generated slides.html to block the inclusion of <script> tags or external document shells, ensuring the final output remains safe and self-contained.
Ingestion points: Ingests data from deck.md, diagnosis.md, and visual reference URLs or screenshots provided by the user.
Boundary markers: Uses explicit role activation instructions and a "note to designer" convention to separate content from instructions.
Capability inventory: Capabilities include file system writes (HTML, CSS, assets) and local shell script execution via the bash tool.
Sanitization: The build-html.sh script actively scans for and rejects generated content containing unauthorized scripts or engine style overrides.
[EXTERNAL_DOWNLOADS]: The skill facilitates the use of Google Fonts via CSS @import statements. Google is a recognized trusted service, and this usage is standard for web-based presentations and poses no security risk to the user's environment.

codeck-design