The Agent Skills Directory

[SAFE]: The skill instructions and templates promote secure development practices. The provided JavaScript helper function el explicitly uses document.createTextNode and setAttribute instead of innerHTML, which effectively prevents Cross-Site Scripting (XSS) vulnerabilities when rendering course content.
[COMMAND_EXECUTION]: The skill recommends using npx serve for local development. This is a standard, well-known utility for serving static files over HTTP and does not pose a security risk in this context.
[EXTERNAL_DOWNLOADS]: The HTML template references Google Fonts (fonts.googleapis.com and fonts.gstatic.com). These are recognized as well-known, trusted services and the references are documented neutrally.
[DATA_EXFILTRATION]: The skill uses localStorage for persisting user progress. This data remains on the user's machine, is scoped to the origin of the site, and there is no logic present to exfiltrate this data to external servers.
[PROMPT_INJECTION]: No evidence of prompt injection, role-play bypasses, or instructions to ignore safety guidelines were found in the skill metadata or body.

static-spa-conversion