The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches typography resources from Google's well-known font services (fonts.googleapis.com and fonts.gstatic.com) to render UI mockups.
[COMMAND_EXECUTION]: Utilizes Node.js subprocesses to manage the lifecycle of the local review server and open the browser. Command-line inputs such as ports and directory paths are validated as integers or resolved using absolute paths to prevent injection.
[OBFUSCATION]: Bundles a minified version of the standard html2canvas library for screenshot generation. This is a common practice for web libraries and the skill includes corresponding third-party notices and license information.
[INDIRECT_PROMPT_INJECTION]: The skill ingests design tokens and project instructions to generate UI fragments. It mitigates potential risks from malicious generated content by rendering mockups in isolated frames and disabling scripts in exported snapshots.
[SAFE]: The server implementation follows security best practices by binding to the loopback interface (127.0.0.1) by default, verifying the Origin header of incoming requests to prevent CSRF, and using realpath verification to guard against directory traversal and symlink attacks.

design-explorer